Play interactive tour

Edit tour

Analysis Report PO#560.zip.exe

Overview

General Information

Sample Name:	PO#560.zip.exe
Analysis ID:	383967
MD5:	225f5938273f006356fd813e46e3fcef
SHA1:	347cd34fd095ae8f843ee436dde5043bba8fb192
SHA256:	69a395d24a3536ef7698ae036596bed55856d4777356946f498faec3f1395f8d
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains method to dynamically call methods (often used by packers)

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses an obfuscated file name to hide its real file extension (double extension)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

PO#560.zip.exe (PID: 3468 cmdline: 'C:\Users\user\Desktop\PO#560.zip.exe' MD5: 225F5938273F006356FD813E46E3FCEF)

PO#560.zip.exe (PID: 5448 cmdline: {path} MD5: 225F5938273F006356FD813E46E3FCEF)

explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

systray.exe (PID: 4952 cmdline: C:\Windows\SysWOW64\systray.exe MD5: 1373D481BE4C8A6E5F5030D2FB0A0C68)

cmd.exe (PID: 1308 cmdline: /c del 'C:\Users\user\Desktop\PO#560.zip.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.talllensphotography.com/md5/"], "decoy": ["gnd3.com", "thedrata.com", "carbeloy.com", "impactpittsburg.com", "sussage.com", "mikespencil.com", "ghoshtechno.com", "partnermassagetherapy.com", "nagago.asia", "parkviee.com", "kichisanpo.com", "awbaviation.com", "shopvibeup.com", "ab-alamode.com", "cash4homesutah.com", "funbrushstrokes.com", "adeleycar.com", "actsbooking.com", "rojorodi.icu", "fleurdelyscantho.com", "bobwhiteknives.com", "entrefloresdr.com", "eurostarcellars.com", "shipu143.com", "lindsaydrees.com", "turningtecc.com", "reusedearth.com", "theemperorbrand.com", "afrohiphops.com", "officehoursonly.com", "pharmacistscbd.com", "yaanpay.com", "mymoxypets.com", "sharehealthalliance.com", "sparktvnetwork.com", "marymoorridgecondo.com", "honest-woman.com", "blitzerfoto.net", "vanhanhnhansu.com", "lawyerspledge.com", "parkwashingtondc.com", "worldwideexpressweb.net", "oatml.com", "acquaintancenutritious.info", "lukmanmalik.xyz", "eudorabcantik.com", "fotosdepueblo.com", "latelierp.com", "dogmomtreats.com", "beerthirtyslc.com", "greenlightsmokables.com", "newyorkbusinesssolutions.com", "latravesia.net", "worldvisioncompany.com", "radiusbrisbane.com", "beachhammocking.com", "games-daizo.com", "customkreation.com", "universiteyehazirlan.com", "studentpalace.rentals", "vizecix.com", "new123movies.pro", "skincolored.com", "goldstespresso.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x1a3050:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1a32ca:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1cf870:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1cfaea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1aeded:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1db60d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1ae8d9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1db0f9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1aeeef:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1db70f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1af067:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x1db887:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x1a3ce2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1d0502:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1adb54:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1da374:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1a49db:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d11fb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b4a8f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e12af:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b5a92:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1b1b71:$sqlite3step: 68 34 1C 7B E1 0x1b1c84:$sqlite3step: 68 34 1C 7B E1 0x1de391:$sqlite3step: 68 34 1C 7B E1 0x1de4a4:$sqlite3step: 68 34 1C 7B E1 0x1b1ba0:$sqlite3text: 68 38 2A 90 C5 0x1b1cc5:$sqlite3text: 68 38 2A 90 C5 0x1de3c0:$sqlite3text: 68 38 2A 90 C5 0x1de4e5:$sqlite3text: 68 38 2A 90 C5 0x1b1bb3:$sqlite3blob: 68 53 D8 7F 8C 0x1b1cdb:$sqlite3blob: 68 53 D8 7F 8C 0x1de3d3:$sqlite3blob: 68 53 D8 7F 8C 0x1de4fb:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: PO#560.zip.exe PID: 3468	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.PO#560.zip.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.PO#560.zip.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.PO#560.zip.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
4.2.PO#560.zip.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.PO#560.zip.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.PO#560.zip.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17609:$sqlite3step: 68 34 1C 7B E1 0x1771c:$sqlite3step: 68 34 1C 7B E1 0x17638:$sqlite3text: 68 38 2A 90 C5 0x1775d:$sqlite3text: 68 38 2A 90 C5 0x1764b:$sqlite3blob: 68 53 D8 7F 8C 0x17773:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: www.talllensphotography.com/md5/	Avira URL Cloud: Label: malware
Source: http://www.talllensphotography.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.talllensphotography.com/md5/"], "decoy": ["gnd3.com", "thedrata.com", "carbeloy.com", "impactpittsburg.com", "sussage.com", "mikespencil.com", "ghoshtechno.com", "partnermassagetherapy.com", "nagago.asia", "parkviee.com", "kichisanpo.com", "awbaviation.com", "shopvibeup.com", "ab-alamode.com", "cash4homesutah.com", "funbrushstrokes.com", "adeleycar.com", "actsbooking.com", "rojorodi.icu", "fleurdelyscantho.com", "bobwhiteknives.com", "entrefloresdr.com", "eurostarcellars.com", "shipu143.com", "lindsaydrees.com", "turningtecc.com", "reusedearth.com", "theemperorbrand.com", "afrohiphops.com", "officehoursonly.com", "pharmacistscbd.com", "yaanpay.com", "mymoxypets.com", "sharehealthalliance.com", "sparktvnetwork.com", "marymoorridgecondo.com", "honest-woman.com", "blitzerfoto.net", "vanhanhnhansu.com", "lawyerspledge.com", "parkwashingtondc.com", "worldwideexpressweb.net", "oatml.com", "acquaintancenutritious.info", "lukmanmalik.xyz", "eudorabcantik.com", "fotosdepueblo.com", "latelierp.com", "dogmomtreats.com", "beerthirtyslc.com", "greenlightsmokables.com", "newyorkbusinesssolutions.com", "latravesia.net", "worldvisioncompany.com", "radiusbrisbane.com", "beachhammocking.com", "games-daizo.com", "customkreation.com", "universiteyehazirlan.com", "studentpalace.rentals", "vizecix.com", "new123movies.pro", "skincolored.com", "goldstespresso.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: PO#560.zip.exe	Virustotal: Detection: 32%			Perma Link
Source: PO#560.zip.exe	ReversingLabs: Detection: 41%

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE

Source: 4.2.PO#560.zip.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: PO#560.zip.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PO#560.zip.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: systray.pdb source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source:	Binary string: systray.pdbGCTL source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe, 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe

Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4x nop then pop edi		4_2_00416C9C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 4x nop then pop edi		10_2_008C6C9C

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 185.53.177.14:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 185.53.177.14:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49734 -> 185.53.177.14:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 50.118.194.26:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 50.118.194.26:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 50.118.194.26:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.talllensphotography.com/md5/

Source: global traffic	HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 HTTP/1.1Host: www.mymoxypets.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8 HTTP/1.1Host: www.new123movies.proConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV HTTP/1.1Host: www.talllensphotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 151.101.1.211 151.101.1.211

Source: Joe Sandbox View	ASN Name: FASTLYUS FASTLYUS
Source: Joe Sandbox View	ASN Name: EGIHOSTINGUS EGIHOSTINGUS
Source: Joe Sandbox View	ASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE

Source: global traffic	HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 HTTP/1.1Host: www.mymoxypets.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8 HTTP/1.1Host: www.new123movies.proConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV HTTP/1.1Host: www.talllensphotography.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.mymoxypets.com

Source: explorer.exe, 00000005.00000000.261798460.00000000089BF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO#560.zip.exe, 00000000.00000003.222424567.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: PO#560.zip.exe, 00000000.00000003.213421217.00000000060AF000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com2
Source: PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com3
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com9
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comC
Source: PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comI
Source: PO#560.zip.exe, 00000000.00000003.214819617.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comQ
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC)
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTCm
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coma
Source: PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comc
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comdd_
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comego
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comwdth
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO#560.zip.exe, 00000000.00000003.215738986.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers#
Source: PO#560.zip.exe, 00000000.00000003.215703797.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO#560.zip.exe, 00000000.00000003.216534912.00000000060B0000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO#560.zip.exe, 00000000.00000003.216063105.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO#560.zip.exe, 00000000.00000003.215780122.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers_
Source: PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comasef
Source: PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comav
Source: PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comrsiv
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn;
Source: PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnt-i%
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000003.214435274.000000000608A000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO#560.zip.exe, 00000000.00000003.214335139.0000000006083000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//d1
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/I
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/R
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/d
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/en-u
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/hs
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PO#560.zip.exe, 00000000.00000003.214608357.000000000608C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/I
Source: PO#560.zip.exe, 00000000.00000003.214608357.000000000608C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/hs
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n-u
Source: PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/w
Source: PO#560.zip.exe, 00000000.00000003.213421217.00000000060AF000.00000004.00000001.sdmp	String found in binary or memory: http://www.microsoft.
Source: PO#560.zip.exe, 00000000.00000003.215072761.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: PO#560.zip.exe, 00000000.00000003.215261953.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.4
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnalv
Source: PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnbio
Source: PO#560.zip.exe	String found in binary or memory: https://github.com/michel-pi/EasyBot.Net
Source: systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: https://my.bigcartel.com;
Source: systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G
Source: systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3

Source: PO#560.zip.exe, 00000000.00000002.233962937.0000000001540000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PO#560.zip.exe

Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419D60 NtCreateFile,	4_2_00419D60
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419E10 NtReadFile,	4_2_00419E10
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419E90 NtClose,	4_2_00419E90
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419F40 NtAllocateVirtualMemory,	4_2_00419F40
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419E0B NtReadFile,	4_2_00419E0B
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419E8A NtClose,	4_2_00419E8A
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00419F3A NtAllocateVirtualMemory,	4_2_00419F3A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A095D0 NtClose,LdrInitializeThunk,	10_2_04A095D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09540 NtReadFile,LdrInitializeThunk,	10_2_04A09540
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A096E0 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_04A096E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A096D0 NtCreateKey,LdrInitializeThunk,	10_2_04A096D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09660 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_04A09660
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09650 NtQueryValueKey,LdrInitializeThunk,	10_2_04A09650
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09780 NtMapViewOfSection,LdrInitializeThunk,	10_2_04A09780
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09FE0 NtCreateMutant,LdrInitializeThunk,	10_2_04A09FE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09710 NtQueryInformationToken,LdrInitializeThunk,	10_2_04A09710
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09860 NtQuerySystemInformation,LdrInitializeThunk,	10_2_04A09860
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09840 NtDelayExecution,LdrInitializeThunk,	10_2_04A09840
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A099A0 NtCreateSection,LdrInitializeThunk,	10_2_04A099A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09910 NtAdjustPrivilegesToken,LdrInitializeThunk,	10_2_04A09910
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09A50 NtCreateFile,LdrInitializeThunk,	10_2_04A09A50
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A095F0 NtQueryInformationFile,	10_2_04A095F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09520 NtWaitForSingleObject,	10_2_04A09520
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A0AD30 NtSetContextThread,	10_2_04A0AD30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09560 NtWriteFile,	10_2_04A09560
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09610 NtEnumerateValueKey,	10_2_04A09610
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09670 NtQueryInformationProcess,	10_2_04A09670
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A097A0 NtUnmapViewOfSection,	10_2_04A097A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09730 NtQueryVirtualMemory,	10_2_04A09730
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A0A710 NtOpenProcessToken,	10_2_04A0A710
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09760 NtOpenProcess,	10_2_04A09760
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A0A770 NtOpenThread,	10_2_04A0A770
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09770 NtSetInformationFile,	10_2_04A09770
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A098A0 NtWriteVirtualMemory,	10_2_04A098A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A098F0 NtReadVirtualMemory,	10_2_04A098F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09820 NtEnumerateKey,	10_2_04A09820
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A0B040 NtSuspendThread,	10_2_04A0B040
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A099D0 NtCreateProcessEx,	10_2_04A099D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09950 NtQueueApcThread,	10_2_04A09950
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09A80 NtOpenDirectoryObject,	10_2_04A09A80
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09A20 NtResumeThread,	10_2_04A09A20
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09A00 NtProtectVirtualMemory,	10_2_04A09A00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09A10 NtQuerySection,	10_2_04A09A10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A0A3B0 NtGetContextThread,	10_2_04A0A3B0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A09B00 NtSetValueKey,	10_2_04A09B00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9D60 NtCreateFile,	10_2_008C9D60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9E90 NtClose,	10_2_008C9E90
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9E10 NtReadFile,	10_2_008C9E10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9F40 NtAllocateVirtualMemory,	10_2_008C9F40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9E8A NtClose,	10_2_008C9E8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9E0B NtReadFile,	10_2_008C9E0B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C9F3A NtAllocateVirtualMemory,	10_2_008C9F3A

Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_017AC204	0_2_017AC204
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_017AE630	0_2_017AE630
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_017AE620	0_2_017AE620
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE0B20	0_2_02FE0B20
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE1EC8	0_2_02FE1EC8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE46B0	0_2_02FE46B0
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE4F70	0_2_02FE4F70
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE7CF5	0_2_02FE7CF5
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE4C78	0_2_02FE4C78
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE0A98	0_2_02FE0A98
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE23C8	0_2_02FE23C8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE0040	0_2_02FE0040
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE0007	0_2_02FE0007
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE4958	0_2_02FE4958
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE494B	0_2_02FE494B
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE1EB8	0_2_02FE1EB8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE46A1	0_2_02FE46A1
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE6E98	0_2_02FE6E98
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE6E88	0_2_02FE6E88
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE0FE8	0_2_02FE0FE8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE0FD8	0_2_02FE0FD8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE4F60	0_2_02FE4F60
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE4C69	0_2_02FE4C69
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE15E8	0_2_02FE15E8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE15A8	0_2_02FE15A8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE6510	0_2_02FE6510
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE6500	0_2_02FE6500
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041E841	4_2_0041E841
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041D018	4_2_0041D018
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00401030	4_2_00401030
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041E1FC	4_2_0041E1FC
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00402D87	4_2_00402D87
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00402D90	4_2_00402D90
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00409E40	4_2_00409E40
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00409E3B	4_2_00409E3B
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041E7E7	4_2_0041E7E7
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_00402FB0	4_2_00402FB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D841F	10_2_049D841F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8D466	10_2_04A8D466
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2581	10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A925DD	10_2_04A925DD
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DD5E0	10_2_049DD5E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A92D07	10_2_04A92D07
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C0D20	10_2_049C0D20
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A91D55	10_2_04A91D55
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A92EF7	10_2_04A92EF7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E6E30	10_2_049E6E30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8D616	10_2_04A8D616
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A91FF1	10_2_04A91FF1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9DFCE	10_2_04A9DFCE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A920A8	10_2_04A920A8
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DB090	10_2_049DB090
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A928EC	10_2_04A928EC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9E824	10_2_04A9E824
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81002	10_2_04A81002
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CF900	10_2_049CF900
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E4120	10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A922AE	10_2_04A922AE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A7FA2B	10_2_04A7FA2B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FEBB0	10_2_049FEBB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A803DA	10_2_04A803DA
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8DBD2	10_2_04A8DBD2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A92B28	10_2_04A92B28
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008CE1FC	10_2_008CE1FC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008B2D87	10_2_008B2D87
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008B2D90	10_2_008B2D90
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008B9E3B	10_2_008B9E3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008B9E40	10_2_008B9E40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008B2FB0	10_2_008B2FB0

Source: C:\Windows\SysWOW64\systray.exe

Code function: String function: 049CB150 appears 45 times

Source: PO#560.zip.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PO#560.zip.exe, 00000000.00000002.233441652.0000000000E18000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameW vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.236012959.000000000473C000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.247662573.0000000007850000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.234946752.0000000003231000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMetroFramework.dll> vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000000.00000002.233962937.0000000001540000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamesystray.exej% vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000004.00000000.232128127.0000000000D58000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameW vs PO#560.zip.exe
Source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO#560.zip.exe
Source: PO#560.zip.exe	Binary or memory string: OriginalFilenameW vs PO#560.zip.exe

Source: PO#560.zip.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: PO#560.zip.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@4/3

Source: C:\Users\user\Desktop\PO#560.zip.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#560.zip.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe	Mutant created: \Sessions\1\BaseNamedObjects\GxiiSkAr
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3564:120:WilError_01

Source: PO#560.zip.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO#560.zip.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: PO#560.zip.exe	Virustotal: Detection: 32%
Source: PO#560.zip.exe	ReversingLabs: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\PO#560.zip.exe 'C:\Users\user\Desktop\PO#560.zip.exe'
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process created: C:\Users\user\Desktop\PO#560.zip.exe {path}
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO#560.zip.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process created: C:\Users\user\Desktop\PO#560.zip.exe {path}	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO#560.zip.exe'	Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO#560.zip.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO#560.zip.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: systray.pdb source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source:	Binary string: systray.pdbGCTL source: PO#560.zip.exe, 00000004.00000002.279505547.00000000014C9000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe, 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PO#560.zip.exe, 00000004.00000002.279978802.000000000188F000.00000040.00000001.sdmp, systray.exe

Data Obfuscation:

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: PO#560.zip.exe, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 0.2.PO#560.zip.exe.d60000.0.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 0.0.PO#560.zip.exe.d60000.0.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 4.0.PO#560.zip.exe.ca0000.0.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 4.2.PO#560.zip.exe.ca0000.1.unpack, ImageManager/Main.cs	.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)

Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FEAEE5 push FFFFFF8Bh; iretd	0_2_02FEAEE7
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE3FCA push dword ptr [esi]; iretd	0_2_02FE3FD2
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 0_2_02FE3FC3 push 36FFFFFFh; iretd	0_2_02FE3FC8
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_004170A0 pushfd ; retf	4_2_004170A6
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041CEB5 push eax; ret	4_2_0041CF08
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041CF6C push eax; ret	4_2_0041CF72
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041CF02 push eax; ret	4_2_0041CF08
Source: C:\Users\user\Desktop\PO#560.zip.exe	Code function: 4_2_0041CF0B push eax; ret	4_2_0041CF72
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A1D0D1 push ecx; ret	10_2_04A1D0E4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008C70A0 pushfd ; retf	10_2_008C70A6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008CCEB5 push eax; ret	10_2_008CCF08
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008CCF0B push eax; ret	10_2_008CCF72
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008CCF02 push eax; ret	10_2_008CCF08
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_008CCF6C push eax; ret	10_2_008CCF72

Source: initial sample

Static PE information: section name: .text entropy: 7.89802258187

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xEE

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: zip.exe

Static PE information: PO#560.zip.exe

Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: PO#560.zip.exe PID: 3468, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PO#560.zip.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO#560.zip.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe	RDTSC instruction interceptor: First address: 00000000008B98E4 second address: 00000000008B98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe	RDTSC instruction interceptor: First address: 00000000008B9B5E second address: 00000000008B9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\PO#560.zip.exe

Code function: 4_2_00409A90 rdtsc

4_2_00409A90

Source: C:\Users\user\Desktop\PO#560.zip.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe TID: 4112	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe TID: 5464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6684	Thread sleep time: -62000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 912	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PO#560.zip.exe	Thread delayed: delay time: 31500			Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.260973427.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: explorer.exe, 00000005.00000000.253495548.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.261281856.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000002.494378645.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: PO#560.zip.exe, 00000000.00000002.248519683.0000000008645000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000005.00000000.260447855.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PO#560.zip.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe

Code function: 4_2_00409A90 rdtsc

4_2_00409A90

Source: C:\Users\user\Desktop\PO#560.zip.exe

Code function: 4_2_0040ACD0 LdrLoadDll,

4_2_0040ACD0

Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D849B mov eax, dword ptr fs:[00000030h]	10_2_049D849B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A814FB mov eax, dword ptr fs:[00000030h]	10_2_04A814FB
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46CF0 mov eax, dword ptr fs:[00000030h]	10_2_04A46CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46CF0 mov eax, dword ptr fs:[00000030h]	10_2_04A46CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46CF0 mov eax, dword ptr fs:[00000030h]	10_2_04A46CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A98CD6 mov eax, dword ptr fs:[00000030h]	10_2_04A98CD6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9740D mov eax, dword ptr fs:[00000030h]	10_2_04A9740D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9740D mov eax, dword ptr fs:[00000030h]	10_2_04A9740D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9740D mov eax, dword ptr fs:[00000030h]	10_2_04A9740D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81C06 mov eax, dword ptr fs:[00000030h]	10_2_04A81C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h]	10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h]	10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h]	10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46C0A mov eax, dword ptr fs:[00000030h]	10_2_04A46C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FBC2C mov eax, dword ptr fs:[00000030h]	10_2_049FBC2C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FA44B mov eax, dword ptr fs:[00000030h]	10_2_049FA44B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E746D mov eax, dword ptr fs:[00000030h]	10_2_049E746D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5C450 mov eax, dword ptr fs:[00000030h]	10_2_04A5C450
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5C450 mov eax, dword ptr fs:[00000030h]	10_2_04A5C450
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FFD9B mov eax, dword ptr fs:[00000030h]	10_2_049FFD9B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FFD9B mov eax, dword ptr fs:[00000030h]	10_2_049FFD9B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A905AC mov eax, dword ptr fs:[00000030h]	10_2_04A905AC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A905AC mov eax, dword ptr fs:[00000030h]	10_2_04A905AC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h]	10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h]	10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h]	10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h]	10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C2D8A mov eax, dword ptr fs:[00000030h]	10_2_049C2D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h]	10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h]	10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h]	10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2581 mov eax, dword ptr fs:[00000030h]	10_2_049F2581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F1DB5 mov eax, dword ptr fs:[00000030h]	10_2_049F1DB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F1DB5 mov eax, dword ptr fs:[00000030h]	10_2_049F1DB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F1DB5 mov eax, dword ptr fs:[00000030h]	10_2_049F1DB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F35A1 mov eax, dword ptr fs:[00000030h]	10_2_049F35A1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h]	10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h]	10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h]	10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8FDE2 mov eax, dword ptr fs:[00000030h]	10_2_04A8FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A78DF1 mov eax, dword ptr fs:[00000030h]	10_2_04A78DF1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h]	10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h]	10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h]	10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46DC9 mov ecx, dword ptr fs:[00000030h]	10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h]	10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A46DC9 mov eax, dword ptr fs:[00000030h]	10_2_04A46DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DD5E0 mov eax, dword ptr fs:[00000030h]	10_2_049DD5E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DD5E0 mov eax, dword ptr fs:[00000030h]	10_2_049DD5E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8E539 mov eax, dword ptr fs:[00000030h]	10_2_04A8E539
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A4A537 mov eax, dword ptr fs:[00000030h]	10_2_04A4A537
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A98D34 mov eax, dword ptr fs:[00000030h]	10_2_04A98D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F4D3B mov eax, dword ptr fs:[00000030h]	10_2_049F4D3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F4D3B mov eax, dword ptr fs:[00000030h]	10_2_049F4D3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F4D3B mov eax, dword ptr fs:[00000030h]	10_2_049F4D3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D3D34 mov eax, dword ptr fs:[00000030h]	10_2_049D3D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CAD30 mov eax, dword ptr fs:[00000030h]	10_2_049CAD30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E7D50 mov eax, dword ptr fs:[00000030h]	10_2_049E7D50
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A03D43 mov eax, dword ptr fs:[00000030h]	10_2_04A03D43
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A43540 mov eax, dword ptr fs:[00000030h]	10_2_04A43540
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A73D40 mov eax, dword ptr fs:[00000030h]	10_2_04A73D40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EC577 mov eax, dword ptr fs:[00000030h]	10_2_049EC577
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EC577 mov eax, dword ptr fs:[00000030h]	10_2_049EC577
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A446A7 mov eax, dword ptr fs:[00000030h]	10_2_04A446A7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A90EA5 mov eax, dword ptr fs:[00000030h]	10_2_04A90EA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A90EA5 mov eax, dword ptr fs:[00000030h]	10_2_04A90EA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A90EA5 mov eax, dword ptr fs:[00000030h]	10_2_04A90EA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5FE87 mov eax, dword ptr fs:[00000030h]	10_2_04A5FE87
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F36CC mov eax, dword ptr fs:[00000030h]	10_2_049F36CC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A7FEC0 mov eax, dword ptr fs:[00000030h]	10_2_04A7FEC0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A08EC7 mov eax, dword ptr fs:[00000030h]	10_2_04A08EC7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D76E2 mov eax, dword ptr fs:[00000030h]	10_2_049D76E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A98ED6 mov eax, dword ptr fs:[00000030h]	10_2_04A98ED6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F16E0 mov ecx, dword ptr fs:[00000030h]	10_2_049F16E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FA61C mov eax, dword ptr fs:[00000030h]	10_2_049FA61C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FA61C mov eax, dword ptr fs:[00000030h]	10_2_049FA61C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A7FE3F mov eax, dword ptr fs:[00000030h]	10_2_04A7FE3F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CC600 mov eax, dword ptr fs:[00000030h]	10_2_049CC600
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CC600 mov eax, dword ptr fs:[00000030h]	10_2_049CC600
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CC600 mov eax, dword ptr fs:[00000030h]	10_2_049CC600
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F8E00 mov eax, dword ptr fs:[00000030h]	10_2_049F8E00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A81608 mov eax, dword ptr fs:[00000030h]	10_2_04A81608
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CE620 mov eax, dword ptr fs:[00000030h]	10_2_049CE620
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h]	10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h]	10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h]	10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h]	10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h]	10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D7E41 mov eax, dword ptr fs:[00000030h]	10_2_049D7E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8AE44 mov eax, dword ptr fs:[00000030h]	10_2_04A8AE44
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8AE44 mov eax, dword ptr fs:[00000030h]	10_2_04A8AE44
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h]	10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h]	10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h]	10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h]	10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EAE73 mov eax, dword ptr fs:[00000030h]	10_2_049EAE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D766D mov eax, dword ptr fs:[00000030h]	10_2_049D766D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D8794 mov eax, dword ptr fs:[00000030h]	10_2_049D8794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A47794 mov eax, dword ptr fs:[00000030h]	10_2_04A47794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A47794 mov eax, dword ptr fs:[00000030h]	10_2_04A47794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A47794 mov eax, dword ptr fs:[00000030h]	10_2_04A47794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A037F5 mov eax, dword ptr fs:[00000030h]	10_2_04A037F5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EF716 mov eax, dword ptr fs:[00000030h]	10_2_049EF716
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FA70E mov eax, dword ptr fs:[00000030h]	10_2_049FA70E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FA70E mov eax, dword ptr fs:[00000030h]	10_2_049FA70E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9070D mov eax, dword ptr fs:[00000030h]	10_2_04A9070D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A9070D mov eax, dword ptr fs:[00000030h]	10_2_04A9070D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FE730 mov eax, dword ptr fs:[00000030h]	10_2_049FE730
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C4F2E mov eax, dword ptr fs:[00000030h]	10_2_049C4F2E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C4F2E mov eax, dword ptr fs:[00000030h]	10_2_049C4F2E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5FF10 mov eax, dword ptr fs:[00000030h]	10_2_04A5FF10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5FF10 mov eax, dword ptr fs:[00000030h]	10_2_04A5FF10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A98F6A mov eax, dword ptr fs:[00000030h]	10_2_04A98F6A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DEF40 mov eax, dword ptr fs:[00000030h]	10_2_049DEF40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DFF60 mov eax, dword ptr fs:[00000030h]	10_2_049DFF60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A090AF mov eax, dword ptr fs:[00000030h]	10_2_04A090AF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9080 mov eax, dword ptr fs:[00000030h]	10_2_049C9080
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FF0BF mov ecx, dword ptr fs:[00000030h]	10_2_049FF0BF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FF0BF mov eax, dword ptr fs:[00000030h]	10_2_049FF0BF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FF0BF mov eax, dword ptr fs:[00000030h]	10_2_049FF0BF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A43884 mov eax, dword ptr fs:[00000030h]	10_2_04A43884
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A43884 mov eax, dword ptr fs:[00000030h]	10_2_04A43884
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h]	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h]	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h]	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h]	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h]	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F20A0 mov eax, dword ptr fs:[00000030h]	10_2_049F20A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C58EC mov eax, dword ptr fs:[00000030h]	10_2_049C58EC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h]	10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5B8D0 mov ecx, dword ptr fs:[00000030h]	10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h]	10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h]	10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h]	10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A5B8D0 mov eax, dword ptr fs:[00000030h]	10_2_04A5B8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C40E1 mov eax, dword ptr fs:[00000030h]	10_2_049C40E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C40E1 mov eax, dword ptr fs:[00000030h]	10_2_049C40E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C40E1 mov eax, dword ptr fs:[00000030h]	10_2_049C40E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A47016 mov eax, dword ptr fs:[00000030h]	10_2_04A47016
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A47016 mov eax, dword ptr fs:[00000030h]	10_2_04A47016
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A47016 mov eax, dword ptr fs:[00000030h]	10_2_04A47016
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h]	10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h]	10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h]	10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h]	10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F002D mov eax, dword ptr fs:[00000030h]	10_2_049F002D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h]	10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h]	10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h]	10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DB02A mov eax, dword ptr fs:[00000030h]	10_2_049DB02A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A94015 mov eax, dword ptr fs:[00000030h]	10_2_04A94015
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A94015 mov eax, dword ptr fs:[00000030h]	10_2_04A94015
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E0050 mov eax, dword ptr fs:[00000030h]	10_2_049E0050
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E0050 mov eax, dword ptr fs:[00000030h]	10_2_049E0050
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A82073 mov eax, dword ptr fs:[00000030h]	10_2_04A82073
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A91074 mov eax, dword ptr fs:[00000030h]	10_2_04A91074
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A469A6 mov eax, dword ptr fs:[00000030h]	10_2_04A469A6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h]	10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h]	10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h]	10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A849A4 mov eax, dword ptr fs:[00000030h]	10_2_04A849A4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2990 mov eax, dword ptr fs:[00000030h]	10_2_049F2990
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FA185 mov eax, dword ptr fs:[00000030h]	10_2_049FA185
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h]	10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h]	10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h]	10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A451BE mov eax, dword ptr fs:[00000030h]	10_2_04A451BE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EC182 mov eax, dword ptr fs:[00000030h]	10_2_049EC182
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F61A0 mov eax, dword ptr fs:[00000030h]	10_2_049F61A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F61A0 mov eax, dword ptr fs:[00000030h]	10_2_049F61A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A541E8 mov eax, dword ptr fs:[00000030h]	10_2_04A541E8
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CB1E1 mov eax, dword ptr fs:[00000030h]	10_2_049CB1E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CB1E1 mov eax, dword ptr fs:[00000030h]	10_2_049CB1E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CB1E1 mov eax, dword ptr fs:[00000030h]	10_2_049CB1E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9100 mov eax, dword ptr fs:[00000030h]	10_2_049C9100
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9100 mov eax, dword ptr fs:[00000030h]	10_2_049C9100
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9100 mov eax, dword ptr fs:[00000030h]	10_2_049C9100
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F513A mov eax, dword ptr fs:[00000030h]	10_2_049F513A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F513A mov eax, dword ptr fs:[00000030h]	10_2_049F513A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h]	10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h]	10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h]	10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E4120 mov eax, dword ptr fs:[00000030h]	10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E4120 mov ecx, dword ptr fs:[00000030h]	10_2_049E4120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EB944 mov eax, dword ptr fs:[00000030h]	10_2_049EB944
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EB944 mov eax, dword ptr fs:[00000030h]	10_2_049EB944
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CB171 mov eax, dword ptr fs:[00000030h]	10_2_049CB171
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CB171 mov eax, dword ptr fs:[00000030h]	10_2_049CB171
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CC962 mov eax, dword ptr fs:[00000030h]	10_2_049CC962
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FD294 mov eax, dword ptr fs:[00000030h]	10_2_049FD294
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FD294 mov eax, dword ptr fs:[00000030h]	10_2_049FD294
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DAAB0 mov eax, dword ptr fs:[00000030h]	10_2_049DAAB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049DAAB0 mov eax, dword ptr fs:[00000030h]	10_2_049DAAB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FFAB0 mov eax, dword ptr fs:[00000030h]	10_2_049FFAB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h]	10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h]	10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h]	10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h]	10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C52A5 mov eax, dword ptr fs:[00000030h]	10_2_049C52A5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2ACB mov eax, dword ptr fs:[00000030h]	10_2_049F2ACB
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2AE4 mov eax, dword ptr fs:[00000030h]	10_2_049F2AE4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049E3A1C mov eax, dword ptr fs:[00000030h]	10_2_049E3A1C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CAA16 mov eax, dword ptr fs:[00000030h]	10_2_049CAA16
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CAA16 mov eax, dword ptr fs:[00000030h]	10_2_049CAA16
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A04A2C mov eax, dword ptr fs:[00000030h]	10_2_04A04A2C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A04A2C mov eax, dword ptr fs:[00000030h]	10_2_04A04A2C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C5210 mov eax, dword ptr fs:[00000030h]	10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C5210 mov ecx, dword ptr fs:[00000030h]	10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C5210 mov eax, dword ptr fs:[00000030h]	10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C5210 mov eax, dword ptr fs:[00000030h]	10_2_049C5210
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D8A0A mov eax, dword ptr fs:[00000030h]	10_2_049D8A0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8AA16 mov eax, dword ptr fs:[00000030h]	10_2_04A8AA16
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8AA16 mov eax, dword ptr fs:[00000030h]	10_2_04A8AA16
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A7B260 mov eax, dword ptr fs:[00000030h]	10_2_04A7B260
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A7B260 mov eax, dword ptr fs:[00000030h]	10_2_04A7B260
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A98A62 mov eax, dword ptr fs:[00000030h]	10_2_04A98A62
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A0927A mov eax, dword ptr fs:[00000030h]	10_2_04A0927A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h]	10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h]	10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h]	10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049C9240 mov eax, dword ptr fs:[00000030h]	10_2_049C9240
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A54257 mov eax, dword ptr fs:[00000030h]	10_2_04A54257
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8EA55 mov eax, dword ptr fs:[00000030h]	10_2_04A8EA55
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F2397 mov eax, dword ptr fs:[00000030h]	10_2_049F2397
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A95BA5 mov eax, dword ptr fs:[00000030h]	10_2_04A95BA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049FB390 mov eax, dword ptr fs:[00000030h]	10_2_049FB390
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D1B8F mov eax, dword ptr fs:[00000030h]	10_2_049D1B8F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049D1B8F mov eax, dword ptr fs:[00000030h]	10_2_049D1B8F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8138A mov eax, dword ptr fs:[00000030h]	10_2_04A8138A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A7D380 mov ecx, dword ptr fs:[00000030h]	10_2_04A7D380
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F4BAD mov eax, dword ptr fs:[00000030h]	10_2_049F4BAD
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F4BAD mov eax, dword ptr fs:[00000030h]	10_2_049F4BAD
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F4BAD mov eax, dword ptr fs:[00000030h]	10_2_049F4BAD
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A453CA mov eax, dword ptr fs:[00000030h]	10_2_04A453CA
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A453CA mov eax, dword ptr fs:[00000030h]	10_2_04A453CA
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049EDBE9 mov eax, dword ptr fs:[00000030h]	10_2_049EDBE9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h]	10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h]	10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h]	10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h]	10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h]	10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F03E2 mov eax, dword ptr fs:[00000030h]	10_2_049F03E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A8131B mov eax, dword ptr fs:[00000030h]	10_2_04A8131B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CF358 mov eax, dword ptr fs:[00000030h]	10_2_049CF358
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CDB40 mov eax, dword ptr fs:[00000030h]	10_2_049CDB40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F3B7A mov eax, dword ptr fs:[00000030h]	10_2_049F3B7A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049F3B7A mov eax, dword ptr fs:[00000030h]	10_2_049F3B7A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_04A98B58 mov eax, dword ptr fs:[00000030h]	10_2_04A98B58
Source: C:\Windows\SysWOW64\systray.exe	Code function: 10_2_049CDB60 mov ecx, dword ptr fs:[00000030h]	10_2_049CDB60

Source: C:\Users\user\Desktop\PO#560.zip.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 151.101.1.211 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 50.118.194.26 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.mymoxypets.com
Source: C:\Windows\explorer.exe	Domain query: www.new123movies.pro
Source: C:\Windows\explorer.exe	Network Connect: 185.53.177.14 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.talllensphotography.com

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\PO#560.zip.exe

Memory written: C:\Users\user\Desktop\PO#560.zip.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\PO#560.zip.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PO#560.zip.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\PO#560.zip.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\PO#560.zip.exe

Section unmapped: C:\Windows\SysWOW64\systray.exe base address: C50000

Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe	Process created: C:\Users\user\Desktop\PO#560.zip.exe {path}			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO#560.zip.exe'			Jump to behavior

Source: explorer.exe, 00000005.00000002.479927551.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000002.481518579.0000000001980000.00000002.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.261169772.000000000871F000.00000004.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000002.481518579.0000000001980000.00000002.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.481518579.0000000001980000.00000002.00000001.sdmp, systray.exe, 0000000A.00000002.480606169.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Users\user\Desktop\PO#560.zip.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#560.zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO#560.zip.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PO#560.zip.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading11	Input Capture1	Process Discovery2	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information14	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO#560.zip.exe	33%	Virustotal		Browse
PO#560.zip.exe	42%	ReversingLabs	Win32.Trojan.Wacatac

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.PO#560.zip.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
www.new123movies.pro	0%	Virustotal	Browse
dualstack.sni.bigcartel.map.fastly.net	0%	Virustotal	Browse
www.talllensphotography.com	5%	Virustotal	Browse
www.turningtecc.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/hs	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/hs	0%	Avira URL Cloud	safe
http://www.mymoxypets.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnt-i%	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/I	0%	Avira URL Cloud	safe
http://www.carterandcone.com2	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn;	0%	Avira URL Cloud	safe
http://www.carterandcone.com3	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.new123movies.pro/md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8	0%	Avira URL Cloud	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
https://my.bigcartel.com;	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/en-u	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.fontbureau.comasef	0%	Avira URL Cloud	safe
http://www.carterandcone.com9	0%	Avira URL Cloud	safe
http://www.fontbureau.comav	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/n-u	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.carterandcone.comQ	0%	Avira URL Cloud	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//d1	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
www.talllensphotography.com/md5/	100%	Avira URL Cloud	malware
http://www.carterandcone.comTC)	0%	Avira URL Cloud	safe
http://www.carterandcone.comI	0%	Avira URL Cloud	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G	0%	Avira URL Cloud	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/R	0%	Avira URL Cloud	safe
http://www.carterandcone.comego	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/I	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/I	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/I	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.zhongyicts.com.cnbio	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.new123movies.pro	185.53.177.14	true	true	0%, Virustotal, Browse	unknown
dualstack.sni.bigcartel.map.fastly.net	151.101.1.211	true	true	0%, Virustotal, Browse	unknown
www.talllensphotography.com	50.118.194.26	true	true	5%, Virustotal, Browse	unknown
www.turningtecc.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.mymoxypets.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.mymoxypets.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3	true	Avira URL Cloud: safe	unknown
http://www.new123movies.pro/md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8	true	Avira URL Cloud: safe	unknown
www.talllensphotography.com/md5/	true	Avira URL Cloud: malware	low
http://www.talllensphotography.com/md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3	systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/hs	PO#560.zip.exe, 00000000.00000003.214608357.000000000608C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/hs	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/michel-pi/EasyBot.Net	PO#560.zip.exe	false		high
http://www.fontbureau.com/designers?	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cnt-i%	PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/I	PO#560.zip.exe, 00000000.00000003.214608357.000000000608C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com2	PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn;	PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.carterandcone.com3	PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://my.bigcartel.com;	systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.com	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/en-u	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comC	PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comasef	PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com9	PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers_	PO#560.zip.exe, 00000000.00000003.215780122.00000000060B0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comav	PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/n-u	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comQ	PO#560.zip.exe, 00000000.00000003.214819617.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comrsiv	PO#560.zip.exe, 00000000.00000002.241188316.000000000608A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp//d1	PO#560.zip.exe, 00000000.00000003.214335139.0000000006083000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comTC)	PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.comI	PO#560.zip.exe, 00000000.00000003.213964934.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.como.	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G	systray.exe, 0000000A.00000002.485148191.00000000053BF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coma	PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	PO#560.zip.exe, 00000000.00000003.213421217.00000000060AF000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.agfamonotype.	PO#560.zip.exe, 00000000.00000003.222424567.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comc	PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	false		unknown
http://www.carterandcone.comTC	PO#560.zip.exe, 00000000.00000003.213824153.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/R	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comego	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/I	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.microsoft.	PO#560.zip.exe, 00000000.00000003.213421217.00000000060AF000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cnbio	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/w	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	PO#560.zip.exe, 00000000.00000003.212947601.00000000060AE000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.monotype.4	PO#560.zip.exe, 00000000.00000003.215261953.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers/frere-jones.html	PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.monotype.	PO#560.zip.exe, 00000000.00000003.215072761.00000000060B0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000003.214435274.000000000608A000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers#	PO#560.zip.exe, 00000000.00000003.215738986.00000000060B0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers8	PO#560.zip.exe, 00000000.00000003.216534912.00000000060B0000.00000004.00000001.sdmp, PO#560.zip.exe, 00000000.00000002.247136868.0000000007292000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.261880107.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.carterandcone.comdd_	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers:	PO#560.zip.exe, 00000000.00000003.216063105.00000000060B0000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/d	PO#560.zip.exe, 00000000.00000003.214521453.000000000608A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/	PO#560.zip.exe, 00000000.00000003.215703797.00000000060B0000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comwdth	PO#560.zip.exe, 00000000.00000003.213718774.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comTCm	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnalv	PO#560.zip.exe, 00000000.00000003.213564531.00000000060B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.211	dualstack.sni.bigcartel.map.fastly.net	United States	54113	FASTLYUS	true
50.118.194.26	www.talllensphotography.com	United States	18779	EGIHOSTINGUS	true
185.53.177.14	www.new123movies.pro	Germany	61969	TEAMINTERNET-ASDE	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383967
Start date:	08.04.2021
Start time:	13:20:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO#560.zip.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@4/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 20.6% (good quality ratio 17.9%) Quality average: 68.8% Quality standard deviation: 34.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 145
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 40.88.32.150, 23.54.113.53, 52.255.188.83, 52.147.198.201, 168.61.161.212, 95.100.54.203, 20.82.210.154, 23.0.174.185, 23.0.174.200, 23.10.249.26, 23.10.249.43, 20.54.26.129, 104.83.127.80, 104.83.87.75 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, e15275.g.akamaiedge.net, arc.msn.com, cdn.onenote.net.edgekey.net, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, wildcard.weather.microsoft.com.edgekey.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, cdn.onenote.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, ris-prod.trafficmanager.net, tile-service.weather.microsoft.com, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, e1553.dspg.akamaiedge.net Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:21:11	API Interceptor	2x Sleep call for process: PO#560.zip.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
151.101.1.211	PO#41000055885.exe	Get hash	malicious	Browse	www.themelaninkloset.com/s2oc/?8pDp00Hp=4et4FaxN7qEBNT6CH0ez/E8Dsb/i+ag7YHyBfouUYdL2gsctUxkX/3SGPji7Vpx94OAO&GzrL=WBjT_rUpa
	1drive.exe	Get hash	malicious	Browse	www.sunsetcherrydesigns.com/bf3/?ofrxUr=z+RdWRCQVf1bdnGc2R5YR6rM/6sPZTZSg7KrVxVPdery5GTrkAKGAiYLRPGVSBCJDCuD&vL3=DX1ltFKxhhDH0NG
	PO-108561.exe	Get hash	malicious	Browse	www.themelaninkloset.com/s2oc/?6l=UlSp&GTgP=4et4FaxN7qEBNT6CH0ez/E8Dsb/i+ag7YHyBfouUYdL2gsctUxkX/3SGPji7Vpx94OAO
	CIF Warsaw, PL.doc	Get hash	malicious	Browse	www.lohushirts.com/ggm/?2d2lbDM=FmVsm8yJy3o4N73UV6a3eDIgWNbuuxXqXgkL1a345HT6WSTKiLzmujkKUJY5KDL/BcumXA==&3fz=fxopBn3xVHz0wjip
	ORDER 0321.xlsx	Get hash	malicious	Browse	www.kazaniansemporium.com/mdi/?qJE0=G0GpifmhvntLyLO&-ZoXL=Ukkr0xduwJyqlRkW6DLQgok1J3em4aUvaYfD3PuPAT4El0i7xKTf9yliHfHdRikdYVI2Wg==
	aQnaI0DXH8l8WfB.exe	Get hash	malicious	Browse	www.animegriptape.com/uszn/?hBZ=bvW195OsOyiVGNxdZYx0gND0s+5aO8LIQRJvcr0ieH3bam7oATXiZfLwJhm+6mFGC/VP&Wr=LhnLHrv82
	Parcel _009887 .exe	Get hash	malicious	Browse	www.annsdyeshop.com/csw6/?t8bHuZw=Rhb01RneKuHXTPiWjgeUl6S/cUFgmxqkxBOjaeKaGNWDobLhoR5VZAcx9/za/wSI2hT6QRiLPg==&2d=llsp
	NWvnpLrdx4.exe	Get hash	malicious	Browse	www.theindiaallureshop.com/da0a/?0pn=jOU7cI5/+szqhWIjpIydt61kBzYwAKSDHR3RGTYHvzw9khcqjN3kz0fS8ehjw9D2F6h6B+QEdg==&D6Ap=ZfoTzbtx3ht
	Xi4vVgHekF.exe	Get hash	malicious	Browse	www.pinkcouturecollection.com/rina/?GFQL=hH+8hb51AwOfjaxJPL0yauFlUal0NiIgwc48TRuYBxnYS7MgRz93KNxBEzoiKPfIGdpR&wFN0DX=UtX8E
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	www.strawberryhearts.com/h3qo/?zL0lV0=HfJSiNDRC9T1mqopA9EExv7r8pXWCasA0nOTgrYBcQfcawbhGFXSgDSLDZJueGLLScsV&Wzr=H0DXHrHhI0T8J
	9tyZf93qRdNHfVw.exe	Get hash	malicious	Browse	www.animegriptape.com/uszn/?OtQl7=bvW195OsOyiVGNxdZYx0gND0s+5aO8LIQRJvcr0ieH3bam7oATXiZfLwJhmUlW1GG9dP&TT=FhLpvxO
	Shipping Documents PL&BL Draft.exe	Get hash	malicious	Browse	www.strawberryhearts.com/h3qo/?mvHpc=HfJSiNDRC9T1mqopA9EExv7r8pXWCasA0nOTgrYBcQfcawbhGFXSgDSLDap+RnbzM5FS&sPj8=mh84WN0PyZRt
	DHL-Shipment-Documents.scr.exe	Get hash	malicious	Browse	www.lashdreamblvd.com/vnc/?7n38Ura=VL+/i4NcL0iBAexwvYWtmYUgLMAplunlrIdV1ZetG71U4kzfLgJwOR7hriu2EZlGb/Vo&yXoTn8=yZBxIB
	NEW URGENT ORDER FROM PUK ITALIA GROUP SRL.EXE	Get hash	malicious	Browse	www.uniquehairllc.com/k47/?r6=GbwDj4ypT&-ZU=zaEiAUWzhGf00blgYVrxIVSvtD9y5l2u4FGFIU/gdJgDDlZuDG+K6r7n7uEQR8jyp8ma
50.118.194.26	PO#7689.zip.exe	Get hash	malicious	Browse	www.talllensphotography.com/md5/?Jzu4_4C=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYKo8e/vDsV&NrThfj=D48x
185.53.177.14	inquiry 19117030P.xlsx	Get hash	malicious	Browse	www.zunebox.com/pp2/?khX0G=YCG/V5x90Bs8NSXDDDtBJoG4GCoNsYz+F8ezmK1WpQlgtBp/NM+4LhqYC9/Kv1A4xuDj/Q==&VfRhwF=EDKtZh5H9V3tBNR
	6z0GZwvVSRNDV96.exe	Get hash	malicious	Browse	www.tw2dl.com/cpi/?rP0DzZ=1qR/tzchkuTVe7V2erKDG2yNod6xB/0wxqlswUmIPiLW+bT+pfkW7EoZ2Q12By7DbBmv&Lh0h=ZTytW2D0v
	WinRAR4.01.exe	Get hash	malicious	Browse	mahi.fileave.com/mvsmvm.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.talllensphotography.com	PO#7689.zip.exe	Get hash	malicious	Browse	50.118.194.26
dualstack.sni.bigcartel.map.fastly.net	PO#41000055885.exe	Get hash	malicious	Browse	151.101.1.211
	1drive.exe	Get hash	malicious	Browse	151.101.1.211
	PO-108561.exe	Get hash	malicious	Browse	151.101.1.211
	CIF Warsaw, PL.doc	Get hash	malicious	Browse	151.101.1.211
	ORDER 0321.xlsx	Get hash	malicious	Browse	151.101.1.211
	aQnaI0DXH8l8WfB.exe	Get hash	malicious	Browse	151.101.1.211
	PO#652.exe	Get hash	malicious	Browse	151.101.1.211
	Parcel _009887 .exe	Get hash	malicious	Browse	151.101.1.211
	NWvnpLrdx4.exe	Get hash	malicious	Browse	151.101.1.211
	Xi4vVgHekF.exe	Get hash	malicious	Browse	151.101.1.211
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	151.101.1.211
	9tyZf93qRdNHfVw.exe	Get hash	malicious	Browse	151.101.1.211
	Shipping Documents PL&BL Draft.exe	Get hash	malicious	Browse	151.101.1.211
	DHL-Shipment-Documents.scr.exe	Get hash	malicious	Browse	151.101.1.211
	NEW URGENT ORDER FROM PUK ITALIA GROUP SRL.EXE	Get hash	malicious	Browse	151.101.1.211

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TEAMINTERNET-ASDE	safecrypt.exe	Get hash	malicious	Browse	185.53.178.54
	RFQ HAN4323.exe	Get hash	malicious	Browse	185.53.177.11
	Doc.exe	Get hash	malicious	Browse	185.53.178.14
	payment slip_pdf.exe	Get hash	malicious	Browse	185.53.177.10
	iQnbU4o7yx.exe	Get hash	malicious	Browse	185.53.179.28
	requisition from ASTRO EXPRESS.xlsx	Get hash	malicious	Browse	185.53.177.10
	inquiry 19117030P.xlsx	Get hash	malicious	Browse	185.53.177.14
	HwL7D1UcZG.exe	Get hash	malicious	Browse	185.53.177.13
	CREDIT NOTE DEBIT NOTE 30.1.2021.xlsx	Get hash	malicious	Browse	185.53.177.13
	CiL08gVVjl.exe	Get hash	malicious	Browse	185.53.177.13
	Mv Maersk Kleven V949E.xlsx	Get hash	malicious	Browse	185.53.177.13
	Inquiry PR11020204168.xlsx	Get hash	malicious	Browse	185.53.177.13
	PO210119.exe.exe	Get hash	malicious	Browse	185.53.178.53
	payment advice002436_pdf.exe	Get hash	malicious	Browse	185.53.177.10
	PDRgIfT71e.exe	Get hash	malicious	Browse	185.53.177.13
	Payment Advice.xlsx	Get hash	malicious	Browse	185.53.177.13
	payment advice00000789_pdf.exe	Get hash	malicious	Browse	185.53.177.10
	Q52msELKeI.exe	Get hash	malicious	Browse	185.53.178.13
	IMG-CMR.xlsx	Get hash	malicious	Browse	185.53.178.10
	20210111140930669.exe	Get hash	malicious	Browse	185.53.178.13
FASTLYUS	Telekom.jar	Get hash	malicious	Browse	185.199.109.154
	Telekom.jar	Get hash	malicious	Browse	185.199.111.154
	Telekom.jar	Get hash	malicious	Browse	185.199.108.154
	Telekom.jar	Get hash	malicious	Browse	185.199.110.154
	nicoleta.fagaras-DHL_TRACKING_1394942.html	Get hash	malicious	Browse	151.101.12.193
	PO#41000055885.exe	Get hash	malicious	Browse	151.101.1.211
	DHL Paket.jar	Get hash	malicious	Browse	185.199.108.154
	DHL Paket.jar	Get hash	malicious	Browse	185.199.108.154
	agmz0F8LbA.dll	Get hash	malicious	Browse	151.101.114.132
	vniSIKfm4h.dll	Get hash	malicious	Browse	151.101.114.132
	61mwzdX4GC.dll	Get hash	malicious	Browse	151.101.14.132
	WbQrxxnmAO.dll	Get hash	malicious	Browse	151.101.14.132
	aunobp.dll	Get hash	malicious	Browse	151.101.1.44
	J18DGDMA9d	Get hash	malicious	Browse	151.101.112.193
	46578-TR.exe	Get hash	malicious	Browse	151.101.1.195
	syscshost.dll	Get hash	malicious	Browse	151.101.14.132
	syscshost.dll	Get hash	malicious	Browse	151.101.1.44
	GvqwXsjgUm.apk	Get hash	malicious	Browse	199.232.192.233
	GvqwXsjgUm.apk	Get hash	malicious	Browse	199.232.192.233
	BL836477488575.exe	Get hash	malicious	Browse	185.199.108.153
EGIHOSTINGUS	PO4308.exe	Get hash	malicious	Browse	104.164.33.210
	PO7321.exe	Get hash	malicious	Browse	104.164.33.210
	SAKKAB QUOTATION_REQUEST.exe	Get hash	malicious	Browse	107.164.194.71
	RFQ-V-SAM-0321D056-DOC.exe	Get hash	malicious	Browse	104.252.75.179
	RFQ-415532-Refractory Materials for KNPC PROJECT_Tender in Kuwait...xlsx.exe	Get hash	malicious	Browse	107.165.116.66
	Request an Estimate_2021_04_01.exe	Get hash	malicious	Browse	107.186.223.220
	PO PL.exe	Get hash	malicious	Browse	107.186.125.46
	PO#7689.zip.exe	Get hash	malicious	Browse	50.118.194.26
	2021-04-01.exe	Get hash	malicious	Browse	107.186.80.12
	PI.exe	Get hash	malicious	Browse	104.252.75.130
	Inquiry.docx	Get hash	malicious	Browse	50.118.194.27
	BL Draft copy.exe	Get hash	malicious	Browse	107.186.80.9
	g0g865fQ2S.exe	Get hash	malicious	Browse	142.111.47.2
	FTT103634332.exe	Get hash	malicious	Browse	50.117.53.247
	PaymentInvoice.exe	Get hash	malicious	Browse	107.186.80.174
	534ucFq00y.exe	Get hash	malicious	Browse	104.252.75.62
	Order Drawing.exe	Get hash	malicious	Browse	23.27.34.179
	New Order-756678 SEG.exe	Get hash	malicious	Browse	107.165.125.43
	50729032021.xlsx	Get hash	malicious	Browse	205.164.14.67
	1LHKlbcoW3.exe	Get hash	malicious	Browse	205.164.14.67

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#560.zip.exe.log Download File
Process:	C:\Users\user\Desktop\PO#560.zip.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.7305421671176875
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO#560.zip.exe
File size:	935424
MD5:	225f5938273f006356fd813e46e3fcef
SHA1:	347cd34fd095ae8f843ee436dde5043bba8fb192
SHA256:	69a395d24a3536ef7698ae036596bed55856d4777356946f498faec3f1395f8d
SHA512:	a6b9d13ea56e7e22abb484de6c4d5b53b7dc645e23327c9b45d20ce872408d3a9c9c93bdf540e39dd3c4a0206f7fc5008edff5787fad1b2674ebe3e060bbfb9c
SSDEEP:	12288:cZAyLGu2iN5p+QYy+SOndeb/xw2enStrpLZREcsYBrKLyrrkqe0ZfH/V14SiyyjK:OKu115ZYMb/xjeStrBsfyMHW/Ed8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...uKn`..............0..P...........o... ........@.. ....................................@................................

File Icon


Icon Hash:	929296929e9e8eb2

Static PE Info

General
Entrypoint:	0x4b6fe2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x606E4B75 [Thu Apr 8 00:16:53 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
mov dword ptr [eax+4Eh], edx
inc edi
or eax, 000A1A0Ah
add byte ptr [eax], al
add byte ptr [ecx+45h], cl
dec esi
inc esp
scasb
inc edx
pushad
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb6f90	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x2f0ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb5000	0xb5000	False	0.906085441126	data	7.89802258187	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x2f0ac	0x2f200	False	0.362426434019	data	6.24227262152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe8000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xb82b0	0x709e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xbf350	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 318767104, next used block 117440512
RT_ICON	0xcfb78	0x94a8	data
RT_ICON	0xd9020	0x5488	data
RT_ICON	0xde4a8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 224, next used block 117440512
RT_ICON	0xe26d0	0x25a8	data
RT_ICON	0xe4c78	0x10a8	data
RT_ICON	0xe5d20	0x988	data
RT_ICON	0xe66a8	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xe6b10	0x84	data
RT_VERSION	0xe6b94	0x32c	data
RT_MANIFEST	0xe6ec0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2018 - 2021
Assembly Version	3.1.0.5
InternalName	W.exe
FileVersion	3.1.0.5
CompanyName
LegalTrademarks
Comments
ProductName	Image Manager
ProductVersion	3.1.0.5
FileDescription	Image Manager
OriginalFilename	W.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/08/21-13:22:36.529475	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49734	80	192.168.2.3	185.53.177.14
04/08/21-13:22:36.529475	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49734	80	192.168.2.3	185.53.177.14
04/08/21-13:22:36.529475	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49734	80	192.168.2.3	185.53.177.14
04/08/21-13:22:36.553844	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49734	185.53.177.14	192.168.2.3
04/08/21-13:22:57.201417	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49737	80	192.168.2.3	50.118.194.26
04/08/21-13:22:57.201417	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49737	80	192.168.2.3	50.118.194.26
04/08/21-13:22:57.201417	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49737	80	192.168.2.3	50.118.194.26

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 13:22:15.841835022 CEST	49732	80	192.168.2.3	151.101.1.211
Apr 8, 2021 13:22:15.857836008 CEST	80	49732	151.101.1.211	192.168.2.3
Apr 8, 2021 13:22:15.858004093 CEST	49732	80	192.168.2.3	151.101.1.211
Apr 8, 2021 13:22:15.858206034 CEST	49732	80	192.168.2.3	151.101.1.211
Apr 8, 2021 13:22:15.874119997 CEST	80	49732	151.101.1.211	192.168.2.3
Apr 8, 2021 13:22:16.213646889 CEST	80	49732	151.101.1.211	192.168.2.3
Apr 8, 2021 13:22:16.213701963 CEST	80	49732	151.101.1.211	192.168.2.3
Apr 8, 2021 13:22:16.213835955 CEST	49732	80	192.168.2.3	151.101.1.211
Apr 8, 2021 13:22:16.213891983 CEST	49732	80	192.168.2.3	151.101.1.211
Apr 8, 2021 13:22:16.229676962 CEST	80	49732	151.101.1.211	192.168.2.3
Apr 8, 2021 13:22:36.477161884 CEST	49734	80	192.168.2.3	185.53.177.14
Apr 8, 2021 13:22:36.502964973 CEST	80	49734	185.53.177.14	192.168.2.3
Apr 8, 2021 13:22:36.503087044 CEST	49734	80	192.168.2.3	185.53.177.14
Apr 8, 2021 13:22:36.529350996 CEST	80	49734	185.53.177.14	192.168.2.3
Apr 8, 2021 13:22:36.529474974 CEST	49734	80	192.168.2.3	185.53.177.14
Apr 8, 2021 13:22:36.553801060 CEST	80	49734	185.53.177.14	192.168.2.3
Apr 8, 2021 13:22:36.553843975 CEST	80	49734	185.53.177.14	192.168.2.3
Apr 8, 2021 13:22:36.553864002 CEST	80	49734	185.53.177.14	192.168.2.3
Apr 8, 2021 13:22:36.554056883 CEST	49734	80	192.168.2.3	185.53.177.14
Apr 8, 2021 13:22:36.554112911 CEST	49734	80	192.168.2.3	185.53.177.14
Apr 8, 2021 13:22:36.578423023 CEST	80	49734	185.53.177.14	192.168.2.3
Apr 8, 2021 13:22:57.036416054 CEST	49737	80	192.168.2.3	50.118.194.26
Apr 8, 2021 13:22:57.201137066 CEST	80	49737	50.118.194.26	192.168.2.3
Apr 8, 2021 13:22:57.201230049 CEST	49737	80	192.168.2.3	50.118.194.26
Apr 8, 2021 13:22:57.201416969 CEST	49737	80	192.168.2.3	50.118.194.26
Apr 8, 2021 13:22:57.413631916 CEST	80	49737	50.118.194.26	192.168.2.3
Apr 8, 2021 13:22:57.824215889 CEST	49737	80	192.168.2.3	50.118.194.26
Apr 8, 2021 13:22:58.049128056 CEST	80	49737	50.118.194.26	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 13:20:54.496963978 CEST	50620	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:54.509605885 CEST	53	50620	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:55.236493111 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:55.250818968 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:56.199992895 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:56.218528986 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:56.716140032 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:56.729211092 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:57.332408905 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:57.344840050 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:58.054625988 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:58.067919016 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:58.800640106 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:58.813636065 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 8, 2021 13:20:59.689147949 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:20:59.703089952 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:00.481935024 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:00.496642113 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:01.968466043 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:01.980351925 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:03.163866997 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:03.176206112 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:03.881845951 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:03.894516945 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:05.055130005 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:05.068723917 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:10.986519098 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:10.998456955 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:11.804999113 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:11.817593098 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:12.718635082 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:12.730581045 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:13.877083063 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:13.888834953 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:19.788295984 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:19.800942898 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:28.345797062 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:28.392071962 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:32.088255882 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:32.100229025 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 8, 2021 13:21:48.955617905 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:21:48.973728895 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:02.479512930 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:02.492809057 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:12.222604990 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:12.243179083 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:15.785041094 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:15.834970951 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:19.175045013 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:19.207401991 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:36.422780991 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:36.475877047 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:42.826658964 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:42.839353085 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:45.008361101 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:45.021218061 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 8, 2021 13:22:56.757714033 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:22:57.035116911 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 8, 2021 13:23:15.656414032 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:23:15.656864882 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:23:15.675172091 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 8, 2021 13:23:15.676373959 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 8, 2021 13:23:18.321069002 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 8, 2021 13:23:18.384574890 CEST	53	63619	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 13:22:15.785041094 CEST	192.168.2.3	8.8.8.8	0xc3b8	Standard query (0)	www.mymoxypets.com	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:36.422780991 CEST	192.168.2.3	8.8.8.8	0xfb64	Standard query (0)	www.new123movies.pro	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:56.757714033 CEST	192.168.2.3	8.8.8.8	0xdf55	Standard query (0)	www.talllensphotography.com	A (IP address)	IN (0x0001)
Apr 8, 2021 13:23:18.321069002 CEST	192.168.2.3	8.8.8.8	0x4e3d	Standard query (0)	www.turningtecc.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 8, 2021 13:22:15.834970951 CEST	8.8.8.8	192.168.2.3	0xc3b8	No error (0)	www.mymoxypets.com	mymoxypets.bigcartel.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 13:22:15.834970951 CEST	8.8.8.8	192.168.2.3	0xc3b8	No error (0)	mymoxypets.bigcartel.com	dualstack.sni.bigcartel.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 13:22:15.834970951 CEST	8.8.8.8	192.168.2.3	0xc3b8	No error (0)	dualstack.sni.bigcartel.map.fastly.net		151.101.1.211	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:15.834970951 CEST	8.8.8.8	192.168.2.3	0xc3b8	No error (0)	dualstack.sni.bigcartel.map.fastly.net		151.101.65.211	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:15.834970951 CEST	8.8.8.8	192.168.2.3	0xc3b8	No error (0)	dualstack.sni.bigcartel.map.fastly.net		151.101.129.211	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:15.834970951 CEST	8.8.8.8	192.168.2.3	0xc3b8	No error (0)	dualstack.sni.bigcartel.map.fastly.net		151.101.193.211	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:36.475877047 CEST	8.8.8.8	192.168.2.3	0xfb64	No error (0)	www.new123movies.pro		185.53.177.14	A (IP address)	IN (0x0001)
Apr 8, 2021 13:22:57.035116911 CEST	8.8.8.8	192.168.2.3	0xdf55	No error (0)	www.talllensphotography.com		50.118.194.26	A (IP address)	IN (0x0001)
Apr 8, 2021 13:23:18.384574890 CEST	8.8.8.8	192.168.2.3	0x4e3d	Name error (3)	www.turningtecc.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.mymoxypets.com

www.new123movies.pro

www.talllensphotography.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49732	151.101.1.211	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 13:22:15.858206034 CEST	5025	OUT	GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 HTTP/1.1 Host: www.mymoxypets.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 13:22:16.213646889 CEST	5699	IN	HTTP/1.1 301 Moved Permanently server: nginx/1.12.2 content-type: text/html; charset=utf-8 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-security-policy: frame-ancestors https://my.bigcartel.com; location: https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3 cache-control: no-cache x-request-id: 58afe355-13fe-4056-affc-cccda6fdf601 x-runtime: 0.011333 x-lifetime: 60/30 Content-Length: 195 Accept-Ranges: bytes Date: Thu, 08 Apr 2021 11:22:16 GMT Via: 1.1 varnish Age: 0 Connection: close X-Served-By: cache-mxp6975-MXP X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1617880936.867442,VS0,VE340 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 79 6d 6f 78 79 70 65 74 73 2e 63 6f 6d 2f 6d 64 35 3f 49 42 63 54 61 52 3d 44 6a 78 74 69 36 53 68 51 7a 68 38 26 61 6d 70 3b 44 7a 72 4c 48 3d 4b 6d 52 6b 50 43 69 65 31 38 48 47 54 68 73 4b 6b 4a 48 71 4c 4b 4c 72 4b 66 56 44 55 59 4e 32 68 78 64 6c 36 2f 33 78 41 2f 47 2b 41 31 79 53 79 59 7a 4a 64 54 6f 37 4b 4a 50 6d 79 6b 4c 56 46 4c 68 33 22 3e 72 65 64 69 72 65 63 74 65 64 3c 2f 61 3e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body>You are being <a href="https://www.mymoxypets.com/md5?IBcTaR=Djxti6ShQzh8&DzrLH=KmRkPCie18HGThsKkJHqLKLrKfVDUYN2hxdl6/3xA/G+A1ySyYzJdTo7KJPmykLVFLh3">redirected</a>.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49734	185.53.177.14	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 13:22:36.529474974 CEST	6398	OUT	GET /md5/?DzrLH=dXMJ/yrosuk4D2OPjKCB839u/6tvM7QWLhghObYdXqbvabebVJQVkG1vpLTC6vFDwMgu&IBcTaR=Djxti6ShQzh8 HTTP/1.1 Host: www.new123movies.pro Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Apr 8, 2021 13:22:36.553843975 CEST	6399	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Thu, 08 Apr 2021 11:22:36 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49737	50.118.194.26	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 13:22:57.201416969 CEST	6419	OUT	GET /md5/?IBcTaR=Djxti6ShQzh8&DzrLH=JP702FCblU1K1nbBBTKIcgs3vFjx7LTnku6fbfQ3JvhMEqeKMVIpxerk2LYg3Mu/rBkV HTTP/1.1 Host: www.talllensphotography.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xEE
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xEE
GetMessageW	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xEE
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xEE

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PO#560.zip.exe PID: 3468 Parent PID: 5684

General

Start time:	13:21:02
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\PO#560.zip.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PO#560.zip.exe'
Imagebase:	0xd60000
File size:	935424 bytes
MD5 hash:	225F5938273F006356FD813E46E3FCEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.235177972.0000000004239000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: PO#560.zip.exe PID: 5448 Parent PID: 3468

General

Start time:	13:21:13
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\PO#560.zip.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xca0000
File size:	935424 bytes
MD5 hash:	225F5938273F006356FD813E46E3FCEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.279265822.0000000001420000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.279183925.00000000012E0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3388 Parent PID: 5448

General

Start time:	13:21:15
Start date:	08/04/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: systray.exe PID: 4952 Parent PID: 3388

General

Start time:	13:21:31
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\systray.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\systray.exe
Imagebase:	0xc50000
File size:	9728 bytes
MD5 hash:	1373D481BE4C8A6E5F5030D2FB0A0C68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.479474418.0000000000B60000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.479196744.0000000000B10000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 1308 Parent PID: 4952

General

Start time:	13:21:36
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\PO#560.zip.exe'
Imagebase:	0x1130000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3564 Parent PID: 1308

General

Start time:	13:21:36
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO#560.zip.exe PID: 3468 Parent PID: 5684 PO#560.zip.exeCOMMON

Executed Functions

Function 02FE0A98, Relevance: 1.6, Strings: 1, Instructions: 342COMMON

Download Yara Rule

Strings

FT?, xrefs: 02FE0C8E

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID: FT?
API String ID: 0-939083113
Opcode ID: b50127bb03bddc2c15239fefc1b020df9d142f9a075e3be64d94ac7ef735d70a
Instruction ID: 852041ad0cb37796604fbb4285d148b312fb1d4f2685883a22159eaf5a5ff31b
Opcode Fuzzy Hash: b50127bb03bddc2c15239fefc1b020df9d142f9a075e3be64d94ac7ef735d70a
Instruction Fuzzy Hash: 25E19EB4E00249CFCB01DFA8E58999DBFF2FF89355B2884A9C146AB315DB749942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02FE0B20, Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

FT?, xrefs: 02FE0C8E

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID: FT?
API String ID: 0-939083113
Opcode ID: 9c220a9bce31a24f2f3372c1f88f5b48cf97bc04356373bde91ae2014cfd2dbf
Instruction ID: 00716621d9b15bc5f43ff0aea5e178fe59f9391a0fa611d369cd124f316c5e3f
Opcode Fuzzy Hash: 9c220a9bce31a24f2f3372c1f88f5b48cf97bc04356373bde91ae2014cfd2dbf
Instruction Fuzzy Hash: BFD14BB4E01209CFCB04DFA9E54999DBBF2FB88395B64C469D106EB324DB78A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02FE1EC8, Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

#0\^, xrefs: 02FE21C6

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID: #0\^
API String ID: 0-762664183
Opcode ID: 8906de769bad6b7bf1ec3f25ef066cf3236c3a7611bb8898086ff7008f936617
Instruction ID: 326995b5bfaa5ed2bbc6fd37e54f854d7104a2d66cbc4bb045772308ddc149e2
Opcode Fuzzy Hash: 8906de769bad6b7bf1ec3f25ef066cf3236c3a7611bb8898086ff7008f936617
Instruction Fuzzy Hash: BEB158B5E042198BCF05CFEAC5805DEFBF6BF88340F249526D909A7258E7349D42CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02FE1EB8, Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

#0\^, xrefs: 02FE21C6

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID: #0\^
API String ID: 0-762664183
Opcode ID: 3cf7ac331aa74ee8e748bfa47511201cd6e28469f30612b5e889fd823a9c4f0f
Instruction ID: 87363452000e4e31d07501aeda806967f91d44c1ee11a7de96531a7e3dac60f3
Opcode Fuzzy Hash: 3cf7ac331aa74ee8e748bfa47511201cd6e28469f30612b5e889fd823a9c4f0f
Instruction Fuzzy Hash: E2B15774E042598BCF05CFEAC5805DEFBF6BF88340F24952AD905AB258E7349E42CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4F70, Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

J7/y, xrefs: 02FE502D

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID: J7/y
API String ID: 0-3473696165
Opcode ID: 0778ef365265acc221b564dfcad93e7a7cad645c1f3dcd84de838c3e8f99ca9f
Instruction ID: cffcba280a448e18f68cf9d86e021755088a8bb812992c0646203d11bfa7281f
Opcode Fuzzy Hash: 0778ef365265acc221b564dfcad93e7a7cad645c1f3dcd84de838c3e8f99ca9f
Instruction Fuzzy Hash: 6C613871E0562ACBDB28CF6AC944799FBB6BFD8300F1481BAC50DA7614EB305A818F40

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4F60, Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

J7/y, xrefs: 02FE502D

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID: J7/y
API String ID: 0-3473696165
Opcode ID: 53d046b1cc15532122c72ae0925bc5cf515b78a4efd99e7cbdd59fe2e777e557
Instruction ID: 392bfb71baa5778ef2f1f82d18ae2b7175d035fb0b69ddca90058089646fcb69
Opcode Fuzzy Hash: 53d046b1cc15532122c72ae0925bc5cf515b78a4efd99e7cbdd59fe2e777e557
Instruction Fuzzy Hash: 06510B71E1162ACBDB68CF66C844799FBB2BFD8300F14C6AAD509A7614EB305AC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7CF5, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102aa34994859346157ad73f7fa5a94b44de580d61878ff016d00c7f0728a566
Instruction ID: b2da58b00d1a2df0c71f367492af565418a6282073eaff483650023a64979a8f
Opcode Fuzzy Hash: 102aa34994859346157ad73f7fa5a94b44de580d61878ff016d00c7f0728a566
Instruction Fuzzy Hash: 48815575E15248DFCF05EFE5E4805AEFBB6FB89390F24A52AD106AB254E3349942CF04

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4C78, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77bc5903ea18450dc73918484f6bd578f0e51eb74d424f0f70386214a100461
Instruction ID: fcb304586375b49482b7f20d84d1b81e8755ee34933718bcca5013d4a71207fe
Opcode Fuzzy Hash: c77bc5903ea18450dc73918484f6bd578f0e51eb74d424f0f70386214a100461
Instruction Fuzzy Hash: 14715971E06249DBCF05CFA9D5806DEFBF6BF89340F24A42AD106B7254D7349941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4C69, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341d177532cf6e00831b649a49a63be299b31d9f303a92afe80976a1bc916aae
Instruction ID: 664813d19b576e979fb7e028d25d60aa655ec8efdf39d8b529dfde8abcd87cbc
Opcode Fuzzy Hash: 341d177532cf6e00831b649a49a63be299b31d9f303a92afe80976a1bc916aae
Instruction Fuzzy Hash: 45716771E06249EBCF05CFA9E5806DEFBF2BF89350F24A42AD106B7254D7349941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 02FE46A1, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028d56a2cafccae388840b48c49d5e1160a6442811a792841c7f885d5b10b8e7
Instruction ID: 29689154dd78f4be13820fabd408c7aaacd3a78db57285bdf5664dbc2abf9fd5
Opcode Fuzzy Hash: 028d56a2cafccae388840b48c49d5e1160a6442811a792841c7f885d5b10b8e7
Instruction Fuzzy Hash: 3A318675E0520C8BDF08DFA9D8455EDFBF2FB8E340F14A42AC102B7214EB389911CA68

Uniqueness

Uniqueness Score: -1.00%

Function 02FE46B0, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c959743c4a9dcdcf07025ba85901ab175adc9ddc3de94d10ddfaad39b552f84
Instruction ID: e1ac5c1ed202af92fc403bf6d20219028eb1c75d41d6f78eea2bbd26cb8e6952
Opcode Fuzzy Hash: 7c959743c4a9dcdcf07025ba85901ab175adc9ddc3de94d10ddfaad39b552f84
Instruction Fuzzy Hash: 48318A75E1921C8BDF04DFA5D9055EDBBF6FB8E340F10A42AC106B3214EB389801CB68

Uniqueness

Uniqueness Score: -1.00%

Function 017AB740, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 017AB7B0
GetCurrentThread.KERNEL32 ref: 017AB7ED
GetCurrentProcess.KERNEL32 ref: 017AB82A
GetCurrentThreadId.KERNEL32 ref: 017AB883

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: faada1a0d87af68251796f291b81137468b81d32729a587375595aef21ca7eb3
Instruction ID: 780c1f123b65061727fd633665d9a7170541f0affa70d538725570e0ed0db816
Opcode Fuzzy Hash: faada1a0d87af68251796f291b81137468b81d32729a587375595aef21ca7eb3
Instruction Fuzzy Hash: 505147B0A05649CFDB14CFA9D948BAEBFF0BF88314F24825AE419A7350C7749844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 017AB750, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 017AB7B0
GetCurrentThread.KERNEL32 ref: 017AB7ED
GetCurrentProcess.KERNEL32 ref: 017AB82A
GetCurrentThreadId.KERNEL32 ref: 017AB883

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4fa8346a11ad272fb4640fb12fd8c32de3cd7a2ec32a8f4572fd9c752f7e1b8b
Instruction ID: d8f7d0f0d4ca50124c15947c8e962b54856875ae784385a5a1d8cc4dcae1f5c8
Opcode Fuzzy Hash: 4fa8346a11ad272fb4640fb12fd8c32de3cd7a2ec32a8f4572fd9c752f7e1b8b
Instruction Fuzzy Hash: 465146B0A05609CFDB14CFA9D548BAEBBF0BF88314F24855AE419A7350DB74A844CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 017A9428, Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017A966E

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0c413daad7b1024f20f11e28099535c46d7b0a2d4b87f7f95e7337264a77604f
Instruction ID: 3adf0a2dc7af35329dc439dc9781fee084f86f2fa94e81fbed1a6d3c82ca8050
Opcode Fuzzy Hash: 0c413daad7b1024f20f11e28099535c46d7b0a2d4b87f7f95e7337264a77604f
Instruction Fuzzy Hash: DD712570A00B058FD724DF69D44579AFBF1BF88208F508A2DD68ADBA50DB35E815CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02FE6C44, Relevance: 1.6, APIs: 1, Instructions: 147processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02FE6DA3

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7cfd1fe59f2891a6ef85864026045541d2b75442011e29a0b3e707f558507b51
Instruction ID: c6cb7612dc8420296318d7f8ab404ffc131e9418c1ffca0a95eb2a0b1ecf9c2b
Opcode Fuzzy Hash: 7cfd1fe59f2891a6ef85864026045541d2b75442011e29a0b3e707f558507b51
Instruction Fuzzy Hash: 19510571D00219DFDF61CF99C880BDDBBB6AF98314F1484AAE909A7250DB749A88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 017AFDAC, Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 017AFECA

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c2d35bf214a43583b2962ed8e75ccd51d3a4ceb455f80c90cf5405dcff80b791
Instruction ID: e6fd23593c1d6543fbe1b01746d1972c642212087ca2640ec898a4475510f474
Opcode Fuzzy Hash: c2d35bf214a43583b2962ed8e75ccd51d3a4ceb455f80c90cf5405dcff80b791
Instruction Fuzzy Hash: 03513671C04249EFDF05CFA9D840ADDBFB1BF89314F24825AE918AB221D7719855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02FE6C50, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02FE6DA3

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 556ce6758086a1063eb667255f2edfbdc4937c35e09239ff803ca3d7d12e1c29
Instruction ID: 1a16364b5923427ef6d67e7bec1aa5573f6a1359532df66927346d0aa5c37567
Opcode Fuzzy Hash: 556ce6758086a1063eb667255f2edfbdc4937c35e09239ff803ca3d7d12e1c29
Instruction Fuzzy Hash: AD510671D00319DFDF61CF99C880BDDBBB5AF98314F1480A9E909A7250DB749A88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 017AFD58, Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 017AFECA

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b981106a03c67e8b5fe3e40a8b6ee0e41424c01c2157487be0982b7c73405707
Instruction ID: e5d5a76cfc90a9df6ed7d8fd4e5ab22a3662f0cf705b404279351ec745a8b990
Opcode Fuzzy Hash: b981106a03c67e8b5fe3e40a8b6ee0e41424c01c2157487be0982b7c73405707
Instruction Fuzzy Hash: 1B51E071D04209EFDF15CF99D840ADDBFB1BF88314F24825AE908AB220D7719995DF90

Uniqueness

Uniqueness Score: -1.00%

Function 017AFDB8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 017AFECA

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6a894c3875bad8f28734990eac44fa78b6574d5d4ae3f2aa13591286f6ae34a6
Instruction ID: 5f0ec00e0711ea29b431617f26f05d76f2c36c823c85ccb2eaacccbf86976ef8
Opcode Fuzzy Hash: 6a894c3875bad8f28734990eac44fa78b6574d5d4ae3f2aa13591286f6ae34a6
Instruction Fuzzy Hash: AB41AFB1D04309DFDB14CF99D884ADEFBB5BF88314F64822AE919AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017A5364, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 017A5421

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 06120b9e9bb00b6c6ae12bbb56f806b081c861ce83ad2f73b780c8764b049365
Instruction ID: bb8641f0ba422b49ee1879d3a9d64a20b20b05beaf90b103864156353bfbf9c0
Opcode Fuzzy Hash: 06120b9e9bb00b6c6ae12bbb56f806b081c861ce83ad2f73b780c8764b049365
Instruction Fuzzy Hash: 8E41D3B1D04618CFDB24CFA9D844BDDFBB1BF98304F248569D408AB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017A3E6C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 017A5421

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d0dd2a8fb391b5213fd1bf6e158b29868e6614e322f6a9401bb332948ea52ae9
Instruction ID: 9cdab6a898d2fd08e68bad374117152633e7edbf92438bd7f3dae8d98898b40c
Opcode Fuzzy Hash: d0dd2a8fb391b5213fd1bf6e158b29868e6614e322f6a9401bb332948ea52ae9
Instruction Fuzzy Hash: CF41D1B1D0461CCFDB24CFA9C844BDDBBB5BF98308F60856AD408AB251DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02FE77F8, Relevance: 1.6, APIs: 1, Instructions: 66injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02FE788D

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3987f2e2b6fd7484c85597a0474865057142976465a87898b9d7dfdd5961b9a1
Instruction ID: 761bcd9da4290737a325d47b441a1b2a0de7514c491e219d0f9557736c3abe2d
Opcode Fuzzy Hash: 3987f2e2b6fd7484c85597a0474865057142976465a87898b9d7dfdd5961b9a1
Instruction Fuzzy Hash: 372146B19012499FCF00CF99D884BEEFBF4FB48314F10842AE919A3240D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7800, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02FE788D

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8cb1750e924f45d9c3b3dce5cd8ada8ad4e69ad4137511437ef7e3de3517d086
Instruction ID: a790a04b8f0ad549f3c5aba098ae60fa177e2cc3e87146e6378d554ddc13bfbe
Opcode Fuzzy Hash: 8cb1750e924f45d9c3b3dce5cd8ada8ad4e69ad4137511437ef7e3de3517d086
Instruction Fuzzy Hash: 112105B19012099FCF10CF9AD885BEEFBF4FB48314F108429E919A7240D774A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017AB972, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017AB9FF

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb96117d2331e02c792817021c786d121b110d0a621f049eabbabb09bfa15f1a
Instruction ID: c6a17cef3dd273b0bbd181da66d51ff53beaceb282c335ccd8fe1dd8549df5d6
Opcode Fuzzy Hash: cb96117d2331e02c792817021c786d121b110d0a621f049eabbabb09bfa15f1a
Instruction Fuzzy Hash: C82105B59002489FDB10CFA9D884ADEFFF4EB48324F14801AE954A7210D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7683, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02FE7707

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e88d3457bf138c286d0a09f99ea5567d505533ccd0b57d815920e0f5e13f5172
Instruction ID: 9f8dd3a05701b4743ce29464b557b4fc45d25fac991dc1e012bb39aa37c2f41e
Opcode Fuzzy Hash: e88d3457bf138c286d0a09f99ea5567d505533ccd0b57d815920e0f5e13f5172
Instruction Fuzzy Hash: 3A21D0B5901259DFCB10CF9AD985BDEFBF4FB48320F10852AE918A7250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017AB978, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017AB9FF

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8bd411d62f20306a8e603ca8fc86753e125cc4398b6d30714424a944c3d57434
Instruction ID: 1e74743e255a96e41ff8d79566fcd6ca6a043c03cf191d6272db1a1f973dabc5
Opcode Fuzzy Hash: 8bd411d62f20306a8e603ca8fc86753e125cc4398b6d30714424a944c3d57434
Instruction Fuzzy Hash: BA21D5B5904248DFDB10CFA9D984ADEFBF4FB48324F14851AE914A7310D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE75C0, Relevance: 1.6, APIs: 1, Instructions: 60threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 02FE763F

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 0979277c69d37d48f63f55a622fb768c76ab147c5e2d0b11c99f87ad0ba1f6aa
Instruction ID: 0ca658cc831e6c76417a119f6e56dd61ee87ff53be24df4ed80ba7a405ec35f5
Opcode Fuzzy Hash: 0979277c69d37d48f63f55a622fb768c76ab147c5e2d0b11c99f87ad0ba1f6aa
Instruction Fuzzy Hash: 442127B1E046199FCB00CF9AD9857EEFBF4FB48324F14812AD518B7240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7688, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02FE7707

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 288ca56201ef94ac582cad759060d5c7f598fbd65995043790103e1e8d2e089b
Instruction ID: fcbe73ab8f9c9b188c74c6383e00014c0f1a52592b83261d91c3fb874fc3a8f6
Opcode Fuzzy Hash: 288ca56201ef94ac582cad759060d5c7f598fbd65995043790103e1e8d2e089b
Instruction Fuzzy Hash: 3421DEB5901259DFCB10CF9AD985BDEFBF4FB48320F10842AE918A7250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE75C8, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 02FE763F

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 23c0a4a67fd753700370620dbaa3a953f41eba90392bd3decf808f4a96416ee7
Instruction ID: d1c83e07227ea723d4290cb9fb1d741053e30f1186e1b78b2d950eb7a9d02ad7
Opcode Fuzzy Hash: 23c0a4a67fd753700370620dbaa3a953f41eba90392bd3decf808f4a96416ee7
Instruction Fuzzy Hash: 152117B1E046199FCB00CF9AD9857EEFBF8BB48324F14812AD518A7240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A8758, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017A96E9,00000800,00000000,00000000), ref: 017A98FA

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ebf8ed1b1ef61b3504d2a4f775e6e91d57db725b6d3703e7989580b88a7ddd39
Instruction ID: 018c63796b85575fc2e86bcc91b5c79abbe65f22c0e3f063ceb054c5f17f0e4b
Opcode Fuzzy Hash: ebf8ed1b1ef61b3504d2a4f775e6e91d57db725b6d3703e7989580b88a7ddd39
Instruction Fuzzy Hash: 771103B2D04209DFDB10CF9AD844AEEFBF4EB88324F14852AE519A7200C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 017A9888, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017A96E9,00000800,00000000,00000000), ref: 017A98FA

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da487009f3ca6139697097115910601bb8960daf3c24479bb698a3e7f8ae002a
Instruction ID: 4b54801da193c2daf983010df2500db06f6027dd8601924dff525d0d1d310bef
Opcode Fuzzy Hash: da487009f3ca6139697097115910601bb8960daf3c24479bb698a3e7f8ae002a
Instruction Fuzzy Hash: 321114B2D05209DFDB10CFAAD884BEEFBF4EB88314F14852AD519A7200C775A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7750, Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02FE77C3

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3a904e8657fba45a5281f34c3671b6a2cc08f0b1106f157e86a47049952d4e49
Instruction ID: 97d82a3ea43935d46f5c2f0cfbef71e1aee090874fd0cbeb8ca9f2ae2b48f39d
Opcode Fuzzy Hash: 3a904e8657fba45a5281f34c3671b6a2cc08f0b1106f157e86a47049952d4e49
Instruction Fuzzy Hash: 261132B6904209DFCB10CF9AD884BDEFBF4FB48320F208419E929A7210D735A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE7758, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02FE77C3

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eaf6df047e026f21c01430d4a670b7f777e55779bc2b09a15d3b5825f47a4b31
Instruction ID: 47476db576bed42988f5d2975d133496a66a86d4dc2b3cbe08b3dc9539326adf
Opcode Fuzzy Hash: eaf6df047e026f21c01430d4a670b7f777e55779bc2b09a15d3b5825f47a4b31
Instruction Fuzzy Hash: 8F1110B5904249DFCB10CF9AD884BDEBBF8EB88324F208419E529A7210C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE8BE0, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02FE8C45

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 63447831623edda4cdc40eb866fea5947d21cf39a69aa28c7880f205db6e83aa
Instruction ID: 03e844bbe7d37141f71645d90cefa0b7dbea4c31782342f6bd1abaecec7365ca
Opcode Fuzzy Hash: 63447831623edda4cdc40eb866fea5947d21cf39a69aa28c7880f205db6e83aa
Instruction Fuzzy Hash: 601133B5900348DFDB10CF99D885BDEBFF8EB58364F10841AE919A7600C774A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A9608, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017A966E

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4089f8dbf0f3baf4bd5b6e560461ecab8cbdb148fffdcad5cb5bce8f33eff626
Instruction ID: 2909eb16e664c111b685050bd2801658b9e5ee02aa87da536e6dfa0992413a9b
Opcode Fuzzy Hash: 4089f8dbf0f3baf4bd5b6e560461ecab8cbdb148fffdcad5cb5bce8f33eff626
Instruction Fuzzy Hash: C41110B2D006098FDB10CF9AD844BDEFBF4AF88324F14852AD929A7200C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE79B3, Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02FE7A17

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 062e37a206877088f4002d950362b86dba29539d4cee2b260cb55e5691bd79fc
Instruction ID: f5e767048c87717ac6f318bc565a41bd0471ab71575f104d769049e7e97597c1
Opcode Fuzzy Hash: 062e37a206877088f4002d950362b86dba29539d4cee2b260cb55e5691bd79fc
Instruction Fuzzy Hash: D41142B1904249CFCB10CF9AD884BDEFBF8EF88324F24845AD519A7250D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE8BE8, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02FE8C45

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6c681a3d115dfe226ef21b3e92c68f0d4d7fdf61b6250d8405cbc0af29a932f8
Instruction ID: d0ad642075e5ca6df980e2076b1f711570b09c42b1a3cc68359058342c45a020
Opcode Fuzzy Hash: 6c681a3d115dfe226ef21b3e92c68f0d4d7fdf61b6250d8405cbc0af29a932f8
Instruction Fuzzy Hash: 111112B5900348DFDB10CF9AD984BDEBBF8EB48364F10841AE919A7200C374A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE79B8, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02FE7A17

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b43870bb7694955715f77b4348cbaae5939386940934d490864e98a4b34122f7
Instruction ID: 583ad4e0394f91a33d1985865defbaf5473eaa880b8b834154969edcb0bb7f60
Opcode Fuzzy Hash: b43870bb7694955715f77b4348cbaae5939386940934d490864e98a4b34122f7
Instruction Fuzzy Hash: F11123B1904249CFCB10DF9AD984BDEFBF8EB88324F20841AD519A7210C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A9932, Relevance: 1.5, APIs: 1, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017A96E9,00000800,00000000,00000000), ref: 017A98FA

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c8450449aa36e758889f702c702efe5dc5e02dc97f06e72a76360bb4d1de112a
Instruction ID: 453bc63a17aef6c2431e2f4ed300ad904641c647138a4de35592fd8e1270a921
Opcode Fuzzy Hash: c8450449aa36e758889f702c702efe5dc5e02dc97f06e72a76360bb4d1de112a
Instruction Fuzzy Hash: F6019AB2904304CFDB10CF99C8047EAFBF0AF85314F15815AD218AB210C3799909CF61

Uniqueness

Uniqueness Score: -1.00%

Function 013FD4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233806750.00000000013FD000.00000040.00000001.sdmp, Offset: 013FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de536760ed3537725ac73d1c7d5069c7fcbad85c75dde2cb0f2a81662b63f61b
Instruction ID: 617a07a785792511d6e7006f0a3eed8d79810e333295a0c45cf038935c765abd
Opcode Fuzzy Hash: de536760ed3537725ac73d1c7d5069c7fcbad85c75dde2cb0f2a81662b63f61b
Instruction Fuzzy Hash: 292145B1504244DFCF01CF94D9C8B66BF69FB8832CF24856DEA090B206C336D846DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233832374.000000000140D000.00000040.00000001.sdmp, Offset: 0140D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a7c0d8a0738af8cbc89feb550bf17f6570646f55bb684a27689e5520f05144
Instruction ID: c490a90ccaf31db5301b70a345f826cfd3d815cbb204c0e9d9500d60bd7b3401
Opcode Fuzzy Hash: d7a7c0d8a0738af8cbc89feb550bf17f6570646f55bb684a27689e5520f05144
Instruction Fuzzy Hash: C821F871904240DFDB02DFD5D9C0B26BB65FB84724F24C97ED8094B396C736D84ACA61

Uniqueness

Uniqueness Score: -1.00%

Function 0140D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233832374.000000000140D000.00000040.00000001.sdmp, Offset: 0140D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4625aaa69cd36a12a9effe27d64ccb4082af78e6fb1960a79b553a372e7e503
Instruction ID: f4cb069b110ae300916486d46568135aa4fcab5779b58ce0ac2ee817d110789f
Opcode Fuzzy Hash: e4625aaa69cd36a12a9effe27d64ccb4082af78e6fb1960a79b553a372e7e503
Instruction Fuzzy Hash: 3A2106B1904240DFDB16CF94D8C0B16BB65EB44358F24C57ED80D4B396C736D84BCA61

Uniqueness

Uniqueness Score: -1.00%

Function 0140D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233832374.000000000140D000.00000040.00000001.sdmp, Offset: 0140D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297b32cb740dd5cae305fe8b79178d6755609a014aff0f0a7ed57d76b6b28985
Instruction ID: f45228c80052223e7870f67ea2dc2dc57c675070722d69c9749b592e120c9907
Opcode Fuzzy Hash: 297b32cb740dd5cae305fe8b79178d6755609a014aff0f0a7ed57d76b6b28985
Instruction Fuzzy Hash: 792195755093808FCB03CF64D590715BF71EB46214F28C5EBD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 013FD4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233806750.00000000013FD000.00000040.00000001.sdmp, Offset: 013FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a060fbae60cfec1215d68a907ab3b47ae3c6c5111b04881ddb3d72143ace79
Instruction ID: 5db5e2440dd6bc9ca1a7f154fae020f6d8d74b2bf784a253aca09bb6546f748c
Opcode Fuzzy Hash: 71a060fbae60cfec1215d68a907ab3b47ae3c6c5111b04881ddb3d72143ace79
Instruction Fuzzy Hash: C411AF76404280CFCF12CF54D5C8B16BF71FB84328F2886ADD9494B656C336D45ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233832374.000000000140D000.00000040.00000001.sdmp, Offset: 0140D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e140a8a7950bf51ebf11ffa23f115df2679bf2d04b3548f20c996f871ac3cc8e
Instruction ID: a5e65b6ce5dadead981a1f3b3315ef1ae7c35687f33466a3adfc2600af84067a
Opcode Fuzzy Hash: e140a8a7950bf51ebf11ffa23f115df2679bf2d04b3548f20c996f871ac3cc8e
Instruction Fuzzy Hash: CE118E75904280DFDB12CF98D5C4B16BB61FB84224F28C6AED8494B7A6C33AD45ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 013FD745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233806750.00000000013FD000.00000040.00000001.sdmp, Offset: 013FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5b995f0e2a269a14572d0ae16a113536d396e1ed6b74a224a9234d463f208a
Instruction ID: d9e0fbad0948118d4eaae6830100ecc0694e4f241f70a7fd282d7e1f41d8a293
Opcode Fuzzy Hash: ed5b995f0e2a269a14572d0ae16a113536d396e1ed6b74a224a9234d463f208a
Instruction Fuzzy Hash: 1801F7710087C49AE7114E96CDC8B66BB9CDF4167CF18851EEF084F246DB799848CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 013FD744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.233806750.00000000013FD000.00000040.00000001.sdmp, Offset: 013FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d7ed28ba167290d9dc493d50f016b48a6b92d1eec621182c98079923493bad
Instruction ID: 1550cfe218e0e06f35c948e2f3ca699eaeb165630e4f4fe26c2d5ac48d37107d
Opcode Fuzzy Hash: 33d7ed28ba167290d9dc493d50f016b48a6b92d1eec621182c98079923493bad
Instruction Fuzzy Hash: 58F0FC714043849EEB118E19DCC8B62FF98DB41334F18C55EEE084F247C3759844CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02FE23C8, Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d94a02098cb2847deb12c69f6800cf3828b98878dc4e8be8f07a6a7b924bc6d
Instruction ID: cea37434dd9e448dbf089f3e06e262e01178fa264e222d658e05ba777ffd56de
Opcode Fuzzy Hash: 6d94a02098cb2847deb12c69f6800cf3828b98878dc4e8be8f07a6a7b924bc6d
Instruction Fuzzy Hash: A5D1B271E0021A8FCF05CFA9C5956AEBBF6FF88394F14852AC916A7355EB349D018F90

Uniqueness

Uniqueness Score: -1.00%

Function 017AE630, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83babb85123016a4a7ef24a0ef3bca2568b62358a40af95dc61895ce97d4ee6b
Instruction ID: 2759bf2120a30675420ca9e00ee644491d4754d0432585b1371efb5079347dd1
Opcode Fuzzy Hash: 83babb85123016a4a7ef24a0ef3bca2568b62358a40af95dc61895ce97d4ee6b
Instruction Fuzzy Hash: 341295F16117468ED334CF6AE89818D7F61B755338B90C30DD2612BAD9D7BA224ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 017AC204, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b11a597a4187995b3a52b992468f02f675d782c6d8e964bbd1fcf5298df562a
Instruction ID: 46b75db5f73eb411e37691ee60b1145f638ef0d8d2f17fd6b2a733f152f48fb0
Opcode Fuzzy Hash: 0b11a597a4187995b3a52b992468f02f675d782c6d8e964bbd1fcf5298df562a
Instruction Fuzzy Hash: 53A15D32E0061A9FCF15DFE5C8445DEFBB2FFC9300B55826AE905AB265EB31A905CB40

Uniqueness

Uniqueness Score: -1.00%

Function 017AE620, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234268074.00000000017A0000.00000040.00000001.sdmp, Offset: 017A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60309ae7b6272173acf55909b404835a255fb0b334085d3a1f3d9e0f9ae072e6
Instruction ID: 2bf12831bb209e6a8608348a39c73ed06049316e264c718045b000b6391b12da
Opcode Fuzzy Hash: 60309ae7b6272173acf55909b404835a255fb0b334085d3a1f3d9e0f9ae072e6
Instruction Fuzzy Hash: 97C109B1A117468ED724CF6AE88818D7F71BB95338B50C30CD1616B6D8D7B6364ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 02FE4958, Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8edc0fd1f121ed5c8d1fa9ea7f0618190288d79ddfa2043d4873ec20249c0b
Instruction ID: 5dfd508a9c1819b52c425a3c891c03d833dee25058dbeae864c36e4bc89c0dde
Opcode Fuzzy Hash: 0b8edc0fd1f121ed5c8d1fa9ea7f0618190288d79ddfa2043d4873ec20249c0b
Instruction Fuzzy Hash: 008105B5E1520ADBCF04CFA6D4518AEFBB2FB99240F10942AC616F7354D7349A42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE494B, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d907b42dfe8bd000de9656626e0b4bf7144f54ea2b0d9a3c0d60ea345b4db85b
Instruction ID: f98d4e5cec2b7e8a39d12a2c285cefa1c670948340675f9151ca736019680f68
Opcode Fuzzy Hash: d907b42dfe8bd000de9656626e0b4bf7144f54ea2b0d9a3c0d60ea345b4db85b
Instruction Fuzzy Hash: AD7115B5E1520ACFCB04CFA6D4518AEFBB2BB89240B10942AD616F7314D7349A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02FE0FE8, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbc29de650c2db4b55f5238a5c3e5b9bd7c92941e4456e3ffd51650d849a099
Instruction ID: 651a67e661b14e6cad14cb3ca14f44f7fc5167aa0e1d716c0a6c683876021bf3
Opcode Fuzzy Hash: 1fbc29de650c2db4b55f5238a5c3e5b9bd7c92941e4456e3ffd51650d849a099
Instruction Fuzzy Hash: 8E6119B4E001698BDB14CF9AC5805AEFBF3FF89205F24C569D459A7206D7349E42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE0FD8, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271a9ed3b725c721c90aa4930999286b42938f9dcb5b89de59d253e25b440c6a
Instruction ID: 71f992b99b368c44497eb4e96ba5ad2d310df41716314e3900002f0917f190f1
Opcode Fuzzy Hash: 271a9ed3b725c721c90aa4930999286b42938f9dcb5b89de59d253e25b440c6a
Instruction Fuzzy Hash: 80611DB4E041698BDB14CFAAC5805AEFBF3FF85205F28C569D458A7206D7349E41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02FE6510, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0afa217f716bfb3db6c6b150d240e5e0428308861f21eade35aa868ee592796c
Instruction ID: 10bc9f7beae02e871ff625e342e6f2134421a8c090017828a0cf842fdf8fd006
Opcode Fuzzy Hash: 0afa217f716bfb3db6c6b150d240e5e0428308861f21eade35aa868ee592796c
Instruction Fuzzy Hash: 43517CB0E141299BDB04CFA9D980AAEFBB6FF88304F24D569D509A7255D7309E41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02FE6500, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd7bedfdc0fb6b5cd48b752620dfee21d682cb231177e7350d3d5bebd64b574
Instruction ID: 6ba9dd5dc0ed242f292d5bd0fab5fe44d27738459b3d1172a90084d5dcae4950
Opcode Fuzzy Hash: 1dd7bedfdc0fb6b5cd48b752620dfee21d682cb231177e7350d3d5bebd64b574
Instruction Fuzzy Hash: 20519CB0E101299BDB04CFA9D980AAEFBB6BF88300F24D1A9D508A7355C7309E41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02FE0007, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6886b5e019a9f14bc1a90384f5e3b41758fe780a20fbd13cfe702ba05ceda101
Instruction ID: 478df55af2ebcb05f9bf016921f4d98728177f98fd4f21d88591ba5fc760d7de
Opcode Fuzzy Hash: 6886b5e019a9f14bc1a90384f5e3b41758fe780a20fbd13cfe702ba05ceda101
Instruction Fuzzy Hash: B0513B70E09258DFDB45CFAAC84069EFBF3AF8A200F14C0AAC549AB255DB345985CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02FE0040, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b10bfa574742597444f2a8c1fb422cc71391695940c05849ae8de76e79a365a
Instruction ID: d874136d0879c536c962aab5fc00f4bd59d717a51ebc4fb86dc5d4c7e6613fc3
Opcode Fuzzy Hash: 8b10bfa574742597444f2a8c1fb422cc71391695940c05849ae8de76e79a365a
Instruction Fuzzy Hash: AE51F871E01619DFDB58CFAAC88079EFBB3AF88300F14C1AAC509AB214DB745A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02FE15A8, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b7eb1a68bfdb9fd0030aa47d88bfbf96c9ab6f8e08b3a897112199fae0a4bc
Instruction ID: cc18fe9def3848db6d7c1529e9116ea4ec7f3f6b74f107c4358a7485d747458a
Opcode Fuzzy Hash: f4b7eb1a68bfdb9fd0030aa47d88bfbf96c9ab6f8e08b3a897112199fae0a4bc
Instruction Fuzzy Hash: 4A4182B0E052598FDB19CF66C98179EBBB2AF89240F14C0AAD909A7355DB304E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02FE15E8, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a44192b882fb05f2a0b8683748397f7de4d31935d44b88a5bdd52939bb2e7e2
Instruction ID: e0142ab5a679c9f33bd648f9319927e409ecf94083acbe2617ef3dbbec141971
Opcode Fuzzy Hash: 3a44192b882fb05f2a0b8683748397f7de4d31935d44b88a5bdd52939bb2e7e2
Instruction Fuzzy Hash: 68413BB4E012198BDB58CF6AD981B9EFBB2BB88240F14C0A9D60DA7355DB305E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02FE6E98, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fcd62734437038747622741115964e05e6c77e22329696263e48713762c4c49
Instruction ID: 102baafa75851a821e86dc2454a4b4daf21f1021dff6679a1620ac86addf4175
Opcode Fuzzy Hash: 6fcd62734437038747622741115964e05e6c77e22329696263e48713762c4c49
Instruction Fuzzy Hash: 23111771E116189BDB08CFABD94069EFBFBEFC8240F14C02AD508A7214EB305A528F51

Uniqueness

Uniqueness Score: -1.00%

Function 02FE6E88, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234412633.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6cb1312a0e5d9dc7507c61ce53b0d3edad18548a84b48ab7cd7e77c4239b85
Instruction ID: f39fb9390de598d220498d0031ad4c41e47450a3180aa6392a91c8d01e1ae5bf
Opcode Fuzzy Hash: 9f6cb1312a0e5d9dc7507c61ce53b0d3edad18548a84b48ab7cd7e77c4239b85
Instruction Fuzzy Hash: 36212670E116589BDB08CFAAE94069EFBF7AFC8240F14C06AD408A7264EB345A558F52

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO#560.zip.exe PID: 5448 Parent PID: 3468 PO#560.zip.exeCOMMON

Executed Functions

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bd248b349f18b2ced93d1e709abaf342431bbeaaaaa26160fd0c904447d41470
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 45F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158649BE1DA7241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E0B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E0B(void* __ebx, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t21;
				void* _t32;
				intOrPtr* _t33;
				void* _t35;

				_t16 = _a4;
				_t33 = _a4 + 0xc48;
				E0041A960(_t16, _t33,  *((intOrPtr*)(_t16 + 0x10)), 0, 0x2a, _t32);
				_t9 =  &_a32; // 0x414d42
				_t15 =  &_a8; // 0x414d42
				_t21 =  *((intOrPtr*)( *_t33))( *_t15, _a12, _a16, _a20, _a24, _a28,  *_t9, _a36, _a40, _t35); // executed
				return _t21;
			}

0x00419e13
0x00419e1f
0x00419e27
0x00419e32
0x00419e4d
0x00419e55
0x00419e59

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: c33679b382e6bdde0c29e56b404fe5e8b6706e180edfefd1f853ae90ceca90de
Instruction ID: aba11af27b62438099d0834bfdfa6b031bc5a9c200b47ae11c6116239f47aab9
Opcode Fuzzy Hash: c33679b382e6bdde0c29e56b404fe5e8b6706e180edfefd1f853ae90ceca90de
Instruction Fuzzy Hash: 01F0F9B6200108AFCB14CF89CC80DEB77A9EF8C314F158649BE0DA7251C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACD0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041C650( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA70(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCF0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041AEA0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acec
0x0040acef
0x0040acf4
0x0040acf9
0x0040ad03
0x0040ad08
0x0040ad0b
0x0040ad0d
0x0040ad15
0x0040ad1a
0x0040ad1a
0x0040ad21
0x0040ad29
0x0040ad2c
0x0040ad2e
0x0040ad42
0x00000000
0x0040ad44
0x0040ad4a
0x0040acfe
0x0040acfe
0x0040acfe

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: b21dceb9c17b581325113e7f9749888d8b8163c3e846858d6705abbd9991eecb
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: A8015EB5D4020DBBDF10DBA5DC82FDEB3789F54308F0041AAE909A7281F635EB548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D60, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d405ca8330a7760d33d8cb8f94c0e61ce0ec213ce21d6c827413d184fac496c
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: F1F0B2B2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419F3A, Relevance: 1.5, APIs: 1, Instructions: 31
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419F3A(signed int __eax, intOrPtr _a8, void* _a12, PVOID* _a16, long _a20, long* _a24, long _a28, long _a32) {
				long _t15;
				signed int _t23;

				_t23 = __eax * 0x551a0636;
				_t3 = _a8 + 0xc60; // 0xca0
				E0041A960(_a8, _t3,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x30, _t23);
				_t15 = NtAllocateVirtualMemory(_a12, _a16, _a20, _a24, _a28, _a32); // executed
				return _t15;
			}

0x00419f3b
0x00419f4f
0x00419f57
0x00419f79
0x00419f7d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e1b35b28653f6b07248c954791ea8defd081881749ed6df089bde28bea99226b
Instruction ID: bf7949b8c770e73b7f81e396326eb3124c7b0a73be668267e8f232867a77a357
Opcode Fuzzy Hash: e1b35b28653f6b07248c954791ea8defd081881749ed6df089bde28bea99226b
Instruction Fuzzy Hash: 3FF058B2200208ABCB14DF89CC81EA777ACAF88654F118109FE08AB281C230E810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00419F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 9c08e1581e5817f7e91e4b21b7a397560e598f802d56d9274a49c90b7c070efe
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1EF015B2210208ABCB14DF89CC81EEB77ADEF88754F158549BE08A7241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E8A, Relevance: 1.5, APIs: 1, Instructions: 21
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00419E8A(signed int __edx, intOrPtr _a4, void* _a8) {
				long _t14;
				void* _t18;
				void* _t21;

				asm("in al, 0xcb");
				asm("sbb [ebx], bl");
				 *(_t21 + __edx * 2 - 0x75) =  *(_t21 + __edx * 2 - 0x75) & 0xffffffec;
				_push(_t21);
				_t11 = _a4;
				_t8 = _t11 + 0x10; // 0x300
				_t9 = _t11 + 0xc50; // 0x40a923
				E0041A960(_a4, _t9,  *_t8, 0, 0x2c, _t18);
				_t14 = NtClose(_a8); // executed
				return _t14;
			}

0x00419e8a
0x00419e8c
0x00419e8e
0x00419e90
0x00419e93
0x00419e96
0x00419e9f
0x00419ea7
0x00419eb5
0x00419eb9

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 686f36b7a85c43006284917821b9ff9d0fa9667e33a7afc8bb46c719154d312a
Instruction ID: 07f2ff17af6e3214ba3edb17ff880bbfa0e85737f81bc170474561cb7555486c
Opcode Fuzzy Hash: 686f36b7a85c43006284917821b9ff9d0fa9667e33a7afc8bb46c719154d312a
Instruction Fuzzy Hash: 57E086762002146BD720DFA4CC85FDB3B68EF45771F154599F9599B191C230E651C790

Uniqueness

Uniqueness Score: -1.00%

Function 00419E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e68336ecf97fcbff1cce52d5eab911d0c0d253976a6ab71543f56f2ca0e2158f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 6CD012752002146BD710EB99CC85ED7776CEF44760F154459BA5C5B242C530F55086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409A90(intOrPtr* _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407E80(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00408090( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041B810( &_v284, 0x104);
						E0041BE80( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DC0(E00414D60(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe045
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080C0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408140(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409a9b
0x00409aa3
0x00409aa5
0x00409aaa
0x00409aaf
0x00409ac2
0x00409ac7
0x00409ad0
0x00409adc
0x00409aef
0x00409af4
0x00409af7
0x00409b00
0x00409b12
0x00409b17
0x00409b1c
0x00000000
0x00000000
0x00409b1e
0x00409b22
0x00000000
0x00000000
0x00409b24
0x00000000
0x00409b22
0x00409b26
0x00409b29
0x00409b2f
0x00409b31
0x00409b3c
0x00409b41
0x00409b44
0x00409b51
0x00409b5c
0x00409b5e
0x00409b64
0x00409b68
0x00409b6b
0x00409b6b
0x00409b72
0x00409b75
0x00409b7a
0x00409b87
0x00409ab6
0x00409ab6
0x00409ab6

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction ID: 3804b4b6881f0f279124858c5e35b72bf87e4fbc11d5a75f000cd7e24852ad46
Opcode Fuzzy Hash: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction Fuzzy Hash: 64213CB2D4020857CB25D664AD42AEF737CEB54308F04017FE949A3182F7387E49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00408373, Relevance: 1.7, APIs: 1, Instructions: 173
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00408373(signed int __ecx, intOrPtr _a4, intOrPtr _a8, char* _a12, char* _a16) {
				char* _v8;
				char* _v132;
				char* _v136;
				char _v656;
				char* _v668;
				char _v684;
				char _v688;
				char* __ebx;
				intOrPtr __edi;
				char* __esi;
				signed char _t62;

				_t62 = 0x000000fa | __ecx;
				if(_t62 != 0) {
					 *0xC3097FF8 =  *0xC3097FF8 ^ _t62;
				} else {
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0x2ac;
					_push(__ebx);
					_push(__esi);
					_push(__edi);
					__eax = 0;
					_v8 = 0;
					_v688 = 0;
					 &_v684 = E0041B860( &_v684, 0, 0x2a4);
					__esi = _a16;
					__ecx =  *((intOrPtr*)(__esi + 0x300));
					__edi = _a4;
					_push( *((intOrPtr*)(__esi + 0x300)));
					_push(_a4); // executed
					__eax = E004082F0(__eflags); // executed
					__esp = __esp + 0x14;
					__eax = E0041B150(__ecx);
					_t14 =  *((intOrPtr*)(__esi + 0x2d4)) + 0x29000; // 0x29000
					__ebx = __eax + _t14;
					_a16 = 0;
					while(1) {
						__eax = E0040F640(__edi, 0xfe363c80); // executed
						__ecx =  *((intOrPtr*)(__esi + 0x2f4));
						__eax =  &_v688;
						__eax = E00419F00(__edi,  *((intOrPtr*)(__esi + 0x2f4)), __ebx,  &_v688, 0x2a8, 0); // executed
						 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
						__eflags = __eax;
						if(__eax < 0) {
							break;
						}
						__eflags = _v656;
						if(_v656 == 0) {
							L13:
							__eax = _a16;
							__eax = _a16 + 1;
							_a16 = __eax;
							__eflags = __eax - 2;
							if(__eax < 2) {
								continue;
							} else {
								__ebx = _v8;
								goto L17;
							}
						} else {
							__eflags = _v668;
							if(_v668 == 0) {
								goto L13;
							} else {
								__eflags = _v136;
								if(_v136 == 0) {
									goto L13;
								} else {
									__eflags = _v132;
									if(_v132 != 0) {
										__eax = _a12;
										__edx =  &_v688;
										__ebx = 1;
										__eax = E0041B7E0(_a12,  &_v688, 0x2a8);
										L17:
										__ecx =  *((intOrPtr*)(__esi + 0x2f4));
										__eax = E00419E90(__edi,  *((intOrPtr*)(__esi + 0x2f4))); // executed
										__eflags = __ebx;
										if(__ebx == 0) {
											break;
										} else {
											__edx = _v668;
											__eax = _a12;
											__ecx = _v136;
											 *((intOrPtr*)(_a12 + 0x14)) = _v668;
											__edx =  *((intOrPtr*)(__esi + 0x2d0));
											_t34 = __esi + 0x2e8; // 0x2e8
											__eax = _t34;
											 *_t34 = _v136;
											__eax = _a12;
											_t36 = __esi + 0x314; // 0x314
											__ebx = _t36;
											__ecx = 0;
											__eax = _a12 + 0x220;
											 *__ebx = 0x18;
											 *((intOrPtr*)(__esi + 0x318)) = 0;
											 *((intOrPtr*)(__esi + 0x320)) = 0;
											 *((intOrPtr*)(__esi + 0x31c)) = 0;
											 *((intOrPtr*)(__esi + 0x324)) = 0;
											 *((intOrPtr*)(__esi + 0x328)) = 0;
											__eax = E00419710(__edi, _a12 + 0x220,  *((intOrPtr*)(__esi + 0x2d0)), __ebx, _a12 + 0x220);
											__ecx = 0;
											 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
											__eflags = __eax;
											if(__eax < 0) {
												break;
											} else {
												__edx = _v132;
												_t44 = __esi + 0x2e0; // 0x2e0
												__eax = _t44;
												 *((intOrPtr*)(__esi + 0x318)) = 0;
												 *((intOrPtr*)(__esi + 0x320)) = 0;
												 *((intOrPtr*)(__esi + 0x31c)) = 0;
												 *((intOrPtr*)(__esi + 0x324)) = 0;
												 *((intOrPtr*)(__esi + 0x328)) = 0;
												_a12 = _a12 + 0x224;
												 *((intOrPtr*)(__esi + 0x2e4)) = _v132;
												 *__ebx = 0x18;
												 *((intOrPtr*)(__esi + 0x2d0)) = 0x1a;
												__eax = E00419750(__edi, _a12 + 0x224, 0x1a, __ebx, _t44);
												 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
												__eflags = __eax;
												if(__eax < 0) {
													break;
												} else {
													__edx = _a8;
													__esi =  *((intOrPtr*)(__edx + 0x10));
													__esi =  *((intOrPtr*)(__edx + 0x10)) + 0x200;
													__eflags =  *((intOrPtr*)(__edx + 0x10)) + 0x200;
													__eax = E0041ADF0(__ecx);
													__ebx = __eax;
													__eax =  *((intOrPtr*)(__ebx + 0x28));
													__eax = E0041BAD0( *((intOrPtr*)(__ebx + 0x28)));
													__edx =  *((intOrPtr*)(__ebx + 0x28));
													_t59 = __eax + 2; // 0x2
													__ecx = __eax + _t59;
													__eax =  &_v656;
													__eax = E00414A20(__edi,  &_v656, 2, 0); // executed
													_pop(__edi);
													_pop(__esi);
													_pop(__ebx);
													__esp = __ebp;
													_pop(__ebp);
													return __eax;
												}
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						goto L21;
					}
					_pop(__edi);
					_pop(__esi);
					__eax = 0;
					__eflags = 0;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return 0;
				}
				L21:
			}

0x0040837a
0x0040837d
0x00408337
0x0040837f
0x00408380
0x00408381
0x00408383
0x00408389
0x0040838a
0x0040838b
0x0040838c
0x00408394
0x00408397
0x004083a4
0x004083a9
0x004083ac
0x004083b2
0x004083b5
0x004083b6
0x004083b7
0x004083bc
0x004083bf
0x004083ca
0x004083ca
0x004083d1
0x004083e0
0x004083e6
0x004083eb
0x004083f8
0x00408402
0x0040840a
0x00408410
0x00408412
0x00000000
0x00000000
0x00408414
0x0040841c
0x00408436
0x00408436
0x00408439
0x0040843a
0x0040843d
0x00408440
0x00000000
0x00408442
0x00408442
0x00000000
0x00408442
0x0040841e
0x0040841e
0x00408425
0x00000000
0x00408427
0x00408427
0x0040842e
0x00000000
0x00408430
0x00408430
0x00408434
0x00408450
0x00408458
0x00408460
0x00408465
0x0040846d
0x0040846d
0x00408475
0x0040847d
0x0040847f
0x00000000
0x00408481
0x00408481
0x00408487
0x0040848a
0x00408490
0x00408493
0x00408499
0x00408499
0x004084a0
0x004084a2
0x004084a5
0x004084a5
0x004084ac
0x004084af
0x004084b6
0x004084bc
0x004084c2
0x004084c8
0x004084ce
0x004084d4
0x004084da
0x004084df
0x004084e4
0x004084ea
0x004084ec
0x00000000
0x004084f2
0x004084f2
0x004084f5
0x004084f5
0x004084fc
0x00408502
0x00408508
0x0040850e
0x00408514
0x00408520
0x00408528
0x0040852e
0x00408534
0x0040853e
0x00408546
0x0040854c
0x0040854e
0x00000000
0x00408554
0x00408554
0x00408557
0x0040855a
0x0040855a
0x00408560
0x0040856d
0x0040856f
0x00408573
0x00408578
0x0040857b
0x0040857b
0x0040858b
0x00408593
0x0040859b
0x0040859c
0x0040859d
0x0040859e
0x004085a0
0x004085a1
0x004085a1
0x0040854e
0x004084ec
0x00000000
0x00000000
0x00000000
0x00408434
0x0040842e
0x00408425
0x00000000
0x0040841c
0x00408447
0x00408448
0x00408449
0x00408449
0x0040844b
0x0040844c
0x0040844e
0x0040844f
0x0040844f
0x00000000

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a1503ae8d1ed78e4aa957748989022a8b07a6f7f60b313ee9a128ea968a24ef9
Instruction ID: 7625cfdccee7a5b4b160b914f125c1e61d6f6ab5c4e322e664f48797fdf5c5d4
Opcode Fuzzy Hash: a1503ae8d1ed78e4aa957748989022a8b07a6f7f60b313ee9a128ea968a24ef9
Instruction Fuzzy Hash: AE51B4B0600309AFDB24DF64DC85BEB77F8EB48304F00446EF559A7281EB74A941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004082E8, Relevance: 1.6, APIs: 1, Instructions: 57
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004082E8(void* __ebx, void* __edx, void* __edi, intOrPtr _a4, void* _a8, signed int _a1462924530) {
				char _v67;
				char _v68;
				void* _t16;
				signed char _t17;
				signed char _t33;
				void* _t36;
				void* _t38;

				asm("clc");
				 *((intOrPtr*)(__edi + 0x551fe7b5)) =  *((intOrPtr*)(__edi + 0x551fe7b5)) + __edx;
				_t36 = _t38;
				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t32 = _a4 + 0x1c;
				_t16 = E0040ACD0(_a4 + 0x1c, _a4 + 0x1c,  &_v68); // executed
				_t17 = E00414E20(_t32, _t16, 0, 0, 0xc4e7b6d6);
				_t33 = _t17;
				_a1462924530 = _a1462924530 ^ _t17;
			}

0x004082ea
0x004082eb
0x004082f1
0x004082ff
0x00408303
0x0040830e
0x0040831a
0x0040831e
0x0040832e
0x00408333
0x00408337

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 1c4401c066ea417a9545dc2ceca71745dd413ce043673ab0bc1603a0c2c61d3c
Instruction ID: 802b7db70617138706d4f0636bf15bd328693867687cb7b74156b540336ea1db
Opcode Fuzzy Hash: 1c4401c066ea417a9545dc2ceca71745dd413ce043673ab0bc1603a0c2c61d3c
Instruction Fuzzy Hash: EE01D831A803187BE720A6A59C43FFE776CAF40F55F05411EFF04BA1C1E6A8691646FA

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004082F0(void* __eflags, intOrPtr _a4, void* _a8, signed int _a1462924530) {
				char _v67;
				char _v68;
				void* _t14;
				signed char _t15;
				signed char _t27;

				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t26 = _a4 + 0x1c;
				_t14 = E0040ACD0(_a4 + 0x1c, _a4 + 0x1c,  &_v68); // executed
				_t15 = E00414E20(_t26, _t14, 0, 0, 0xc4e7b6d6);
				_t27 = _t15;
				_a1462924530 = _a1462924530 ^ _t15;
			}

0x004082ff
0x00408303
0x0040830e
0x0040831a
0x0040831e
0x0040832e
0x00408333
0x00408337

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction ID: 99221eaed4bb2b1c73ef210b546efabe7985b039c1aa6a3efaa8447a865c7254
Opcode Fuzzy Hash: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction Fuzzy Hash: 7601D831A8031876E720A6959C43FFE772C6B40F54F044019FF04BA1C1D6A8691646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A2, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 16063dae42517bfa6091b2f18c655fd32a8cd51b321d927acab44951dd6ce39e
Instruction ID: 340cfaa90dbac84e7bf05b9d27d849e6823110de8f61185ef2bf1628f03526e7
Opcode Fuzzy Hash: 16063dae42517bfa6091b2f18c655fd32a8cd51b321d927acab44951dd6ce39e
Instruction Fuzzy Hash: CB1132B2200508BBDB18DF98CC81EEB73A9EF8C350F118219FA0CA7241D230E8518BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C2, Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041A1C2(void* __eax, WCHAR* _a4, WCHAR* _a8, struct _LUID* _a12) {
				intOrPtr _v0;
				char _v1;
				int _t14;
				void* _t19;

				_push(cs);
				 *(__eax + 0x1d) =  *(__eax + 0x1d) >> 1;
				asm("lds esi, [edi-0x39785eef]");
				asm("adc byte [ebp-0x75], 0xec");
				_push( &_v1);
				E0041A960(_v0, _v0 + 0xc8c,  *((intOrPtr*)(_v0 + 0xa18)), 0, 0x46, _t19);
				_t14 = LookupPrivilegeValueW(_a4, _a8, _a12); // executed
				return _t14;
			}

0x0041a1c2
0x0041a1c4
0x0041a1c7
0x0041a1cf
0x0041a1d0
0x0041a1ea
0x0041a200
0x0041a204

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8f7e39a7e54f5d283fd236133196eed88695d221e073cc2f9dcd51747603ef0c
Instruction ID: 1bfaad42c5dba08bf377a7d15b36eccc446808edf71f9e9c0dd22e9d054ada6c
Opcode Fuzzy Hash: 8f7e39a7e54f5d283fd236133196eed88695d221e073cc2f9dcd51747603ef0c
Instruction Fuzzy Hash: C9F0E5B16002186FCB20DF64CC41EDB3769EF45360F068298FE4D6B282C630E811CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A062, Relevance: 1.5, APIs: 1, Instructions: 27
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041A062(void* __eax, void* __ebx, intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t13;
				void* _t21;

				asm("rcl dword [ebp-0x75], cl");
				_push(0x2687a41d);
				_t4 = _a4 + 0xc74; // 0xc74
				E0041A960(_a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35, _t21);
				_t13 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t13;
			}

0x0041a06f
0x0041a070
0x0041a07f
0x0041a087
0x0041a09d
0x0041a0a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 195937d59783e975ddc4ffaf283b86398264f71afe0486821d6b1db6a0acf83b
Instruction ID: f2cbfdc186d79de33e18c666acb0b4df94e4156fe3b7b9d71b5b086efcc08ba0
Opcode Fuzzy Hash: 195937d59783e975ddc4ffaf283b86398264f71afe0486821d6b1db6a0acf83b
Instruction Fuzzy Hash: 6AE06DB5200618AFCB18DF65CC48EEB7768EF88350F128658FD099B242D631E8158BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A070, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: ebe44f756a2289fd31ae4d5b5361048190c1dc89d00c79db85c43397b2838655
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 81E01AB12102086BD714DF59CC45EA777ACEF88750F018559B90857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 0bf4e0d92ddb4de2ba6a166865ddf054dca1a4f918bcd24d9368b88a9b8aca1a
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: F1E012B1210208ABDB14EF99CC81EA777ACEF88664F158559BA086B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 46e8f913edfca5d9b668009ee454d724baa27d6f5a7db77fbc9955010344b6d9
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 22E01AB12002086BDB10DF49CC85EE737ADEF88650F018555BA0C67241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B0, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: eb2c75e7f7166c4cf28644cd9339eacac336c717648a3dafe3de7fd5e277bb7f
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 4CD017726102187BD620EB99CC85FD777ACDF48BA0F0584A9BA5C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00416C9C, Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00416C9C(void* __eax, void* __ebx) {
				signed int _t10;

				asm("sbb bh, [esi+ebx*4-0x548f613b]");
				 *(__ebx + 0x2d) =  *(__ebx + 0x2d) | _t10;
				_push(__ebx);
				asm("sbb eax, edi");
				return __eax;
			}

0x00416c9c
0x00416ca3
0x00416ca6
0x00416ca7
0x00416cb3

Memory Dump Source

Source File: 00000004.00000002.278875737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b116c4c31a377a51fde2d530df58e6e36d7bd68116c92be4fc98c54be1115aad
Instruction ID: 418090d7fca0978790b8d11f9e15924669b78987f76feae58985ebf7500b175b
Opcode Fuzzy Hash: b116c4c31a377a51fde2d530df58e6e36d7bd68116c92be4fc98c54be1115aad
Instruction Fuzzy Hash: BBC08CA2E190101981200E2A78C21F0FBA8C0C7022E0823A7E8CAA3001C102C0154188

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: systray.exe PID: 4952 Parent PID: 3388 systray.exeCOMMON

Executed Functions

Function 008C9D60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,008C4B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,008C4B87,007A002E,00000000,00000060,00000000,00000000), ref: 008C9DAD

Strings

.z`, xrefs: 008C9D9D, 008C9DA8

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: fe021f03fca2cac82433b6356b287de4bb9db70f2d2f76f895604dc45d4c9e3e
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: A3F0B2B2200208ABCB48CF88DC85EEB77ADEF8C754F158248BA1D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 008C9E10, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(008C4D42,5EB6522D,FFFFFFFF,008C4A01,?,?,008C4D42,?,008C4A01,FFFFFFFF,5EB6522D,008C4D42,?,00000000), ref: 008C9E55

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 06eb07a09bab2a74561f4fd8938d7d61c1f2ad90cd990d94d8f4dacb2ff45d1d
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: F7F0A9B2200108ABCB14DF89DC81EEB77ADEF8C754F158248BA1D97241D630E8118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008C9E0B, Relevance: 1.5, APIs: 1, Instructions: 35filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(008C4D42,5EB6522D,FFFFFFFF,008C4A01,?,?,008C4D42,?,008C4A01,FFFFFFFF,5EB6522D,008C4D42,?,00000000), ref: 008C9E55

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6c29a0e0afc1308dc00e7d5d1c8201332da7c507154aaf135898f196fc83a8a7
Instruction ID: 636015bb909ca35ec09ec96e51c132b08c15540614db3af689f7d8472893ff50
Opcode Fuzzy Hash: 6c29a0e0afc1308dc00e7d5d1c8201332da7c507154aaf135898f196fc83a8a7
Instruction Fuzzy Hash: 92F0E7B6200108AFCB14CF88CC81EEB77A9EF8C314F118249BA1DA7251C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 008C9F3A, Relevance: 1.5, APIs: 1, Instructions: 31memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,008B2D11,00002000,00003000,00000004), ref: 008C9F79

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 24b671626734e9ed76f9a4dbf97127265e62f4d16fc353e1beead46376c543d7
Instruction ID: c8ac37c120410674b4695ef071ecafd0a3cfce284c5ead48fdb2a7b6b43a0d7d
Opcode Fuzzy Hash: 24b671626734e9ed76f9a4dbf97127265e62f4d16fc353e1beead46376c543d7
Instruction Fuzzy Hash: 47F0FEB62001186BCB14DF99CC91EA777ADEF88654F118159FE18A7241D530E911CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 008C9F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,008B2D11,00002000,00003000,00000004), ref: 008C9F79

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 4784f44b49e1687637c16c7273424773dd406abef983adc4937220009eca7c2c
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 71F015B2200208ABCB18DF89CC81EAB77ADEF88754F118148BE18A7241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008C9E8A, Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(008C4D20,?,?,008C4D20,00000000,FFFFFFFF), ref: 008C9EB5

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: f865309e9bc92f76d609314f966f4d77334ca376d91da5de97342366ba0548c6
Instruction ID: 25ffc0b3565f5fb4ded4d06c9b24d6276641948a2fbcad81497857229e165afb
Opcode Fuzzy Hash: f865309e9bc92f76d609314f966f4d77334ca376d91da5de97342366ba0548c6
Instruction Fuzzy Hash: E0E086762002146BD720DFA4CC85FDB3B68EF45761F154199F9599B191C230E605C790

Uniqueness

Uniqueness Score: -1.00%

Function 008C9E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(008C4D20,?,?,008C4D20,00000000,FFFFFFFF), ref: 008C9EB5

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 8054e00e49f6c0a156238260b7103553acdb4cbd26e76fedb837cfe601a364c8
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: D1D012752002186BD714EB98CC85F977B6CEF44750F154459BA589B242C530F50086E1

Uniqueness

Uniqueness Score: -1.00%

Function 04A095D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A095DA

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ce18c5a8980b3416065e6f2d3d4492b10a149e45477b691a6cd98b8279138469
Instruction ID: d548bc6ccddeec48c1a6d1a7d9860e8c1f8aa12c2cbe44f3e6d737595cef9f2d
Opcode Fuzzy Hash: ce18c5a8980b3416065e6f2d3d4492b10a149e45477b691a6cd98b8279138469
Instruction Fuzzy Hash: 4A9002A120205003610571694414616440A97E0245B51C421E1005591DC565E8917165

Uniqueness

Uniqueness Score: -1.00%

Function 04A09540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0954A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2af271715b8104637036ed3cc408b1a2e7ab094d7ba9fdd52da43f33adb2d4f0
Instruction ID: 33cd8a63a725469cd84a3b475cf5c77a242897ac870feb64fe908dfb3725644b
Opcode Fuzzy Hash: 2af271715b8104637036ed3cc408b1a2e7ab094d7ba9fdd52da43f33adb2d4f0
Instruction Fuzzy Hash: F9900475311050033105F57D07045070447D7D53D5351C431F1007551CD771FC717171

Uniqueness

Uniqueness Score: -1.00%

Function 04A096E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A096EA

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2b72a8a51ff048d26a23c7d0772c3830b6380d51376710729cbe2621fa0c81e5
Instruction ID: 80b42e880ab4c4dca8e68a9cb1fec19750acc7c891d597045e1470347b67a948
Opcode Fuzzy Hash: 2b72a8a51ff048d26a23c7d0772c3830b6380d51376710729cbe2621fa0c81e5
Instruction Fuzzy Hash: FB9002712010D802F1106169840474A040597D0345F55C811A4415659D86D5E8917161

Uniqueness

Uniqueness Score: -1.00%

Function 04A096D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A096DA

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3fc4f20297e2f9354bc1ec387dc015d1f4d536f9a4a58cecd4e5b9e7816b8fec
Instruction ID: f39b9e1c9d2522967e39dff33aab09f4982201467870a000b05617b2eea8174e
Opcode Fuzzy Hash: 3fc4f20297e2f9354bc1ec387dc015d1f4d536f9a4a58cecd4e5b9e7816b8fec
Instruction Fuzzy Hash: 2B90047130105C43F100717D4404F470405D7F0345F51C417F0115755DC755FC517571

Uniqueness

Uniqueness Score: -1.00%

Function 04A09660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0966A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 44ed76f30e9cadf88b18c9c5d6ae67f8a7204a5ed0551e06553f310c13a36903
Instruction ID: e383e50bc64837e4e99f22d2efab8e470485f6d37130676e3cae41df82cd657a
Opcode Fuzzy Hash: 44ed76f30e9cadf88b18c9c5d6ae67f8a7204a5ed0551e06553f310c13a36903
Instruction Fuzzy Hash: EA90027120105802F1807169440464A040597D1345F91C415A0016655DCA55EA5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 04A09650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0965A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 49c01a8d3644e4baf49dd66c123580f6d8f1905a3aa6638798d620f4d161bbf6
Instruction ID: 80aa0e34316c4031a1d7d5333b7a20ac8e286cb07ad3c45f91a0f8771bb33d53
Opcode Fuzzy Hash: 49c01a8d3644e4baf49dd66c123580f6d8f1905a3aa6638798d620f4d161bbf6
Instruction Fuzzy Hash: A890027120509842F14071694404A46041597D0349F51C411A0055695D9665ED55B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A09780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0978A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 69f707756fafc6a23745e7938db515a9f8c1e13d3b588429d4f8e0cc84a53d28
Instruction ID: 5d7b85f0d2e3cad714ef8ec828f94f1403c9cc65167a3d423a085c490df4023e
Opcode Fuzzy Hash: 69f707756fafc6a23745e7938db515a9f8c1e13d3b588429d4f8e0cc84a53d28
Instruction Fuzzy Hash: 0790026921305002F1807169540860A040597D1246F91D815A0006559CC955E8696361

Uniqueness

Uniqueness Score: -1.00%

Function 04A09FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A09FEA

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 41b98dac4144640f2b9381aada2f0dd3e82415a43e98292ed5bd863f040c4424
Instruction ID: a52f302b82bde8233fb3b1eba8e626f1c29a2272dc98473062d24c3e96de0962
Opcode Fuzzy Hash: 41b98dac4144640f2b9381aada2f0dd3e82415a43e98292ed5bd863f040c4424
Instruction Fuzzy Hash: EF90027131119402F11061698404706040597D1245F51C811A0815559D86D5E8917162

Uniqueness

Uniqueness Score: -1.00%

Function 04A09710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0971A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e13a94569e2b855c0bc3a02461d341569cf8a23cbe4e89086ae0f67481d7dd27
Instruction ID: 4ad6e0be3be164bc1a4447a594f0d9bdb5aa3926180d382aa586a8cd20f0d880
Opcode Fuzzy Hash: e13a94569e2b855c0bc3a02461d341569cf8a23cbe4e89086ae0f67481d7dd27
Instruction Fuzzy Hash: 6C90027120105402F10065A95408646040597E0345F51D411A5015556EC6A5E8917171

Uniqueness

Uniqueness Score: -1.00%

Function 04A09860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0986A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39b8a10743ed757c6a9a4a6533907b8ecbf867554e27883474dc8edd236ac4ba
Instruction ID: f1b59ef1d700c38a85d065c82646c4525198273a2cbad7f0528dc595d8c11cf5
Opcode Fuzzy Hash: 39b8a10743ed757c6a9a4a6533907b8ecbf867554e27883474dc8edd236ac4ba
Instruction Fuzzy Hash: DE90027120105413F11161694504707040997D0285F91C812A0415559D9696E952B161

Uniqueness

Uniqueness Score: -1.00%

Function 04A09840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0984A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7c02f64f7e7012cdf22e0d00baf7c35b6283204bfe1c2a0ebd9f3f2cf57d7aa
Instruction ID: bb9d39b507f6f20174649ea7c95c2f669e4cc4600fcfcf64579588e92a6df72e
Opcode Fuzzy Hash: b7c02f64f7e7012cdf22e0d00baf7c35b6283204bfe1c2a0ebd9f3f2cf57d7aa
Instruction Fuzzy Hash: 9A900261242091527545B16944045074406A7E0285791C412A1405951C8566F856E661

Uniqueness

Uniqueness Score: -1.00%

Function 04A099A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A099AA

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4b572177abfc4b0059a025267ae39ce02e6f748dae1e0a558a4e544df98cc33d
Instruction ID: 50678324382ed2669d29d7d15cee7f7a275a033264b4cb92f9d1f92d3a81bf9d
Opcode Fuzzy Hash: 4b572177abfc4b0059a025267ae39ce02e6f748dae1e0a558a4e544df98cc33d
Instruction Fuzzy Hash: 859002A134105442F10061694414B060405D7E1345F51C415E1055555D8659EC527166

Uniqueness

Uniqueness Score: -1.00%

Function 04A09910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A0991A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 394d2c3ed6a3676b2e01dc9d44d460ee8a7001721d72d21852b06b817ef6dc39
Instruction ID: f162cc8aa8e474cdd15762e8ff8b75921b7eab36e4f1698da1f77f9e945ea27a
Opcode Fuzzy Hash: 394d2c3ed6a3676b2e01dc9d44d460ee8a7001721d72d21852b06b817ef6dc39
Instruction Fuzzy Hash: D99002B120105402F14071694404746040597D0345F51C411A5055555E8699EDD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 04A09A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A09A5A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b19000c904187937fbe468e33bf9046907c94a1448308ebc9f3187dab09a2ee8
Instruction ID: 2daa4218b9547c219c973501fe341601a019aa57414bb4bb593e02165a76d1d6
Opcode Fuzzy Hash: b19000c904187937fbe468e33bf9046907c94a1448308ebc9f3187dab09a2ee8
Instruction Fuzzy Hash: 5A90026121185042F20065794C14B07040597D0347F51C515A0145555CC955E8616561

Uniqueness

Uniqueness Score: -1.00%

Function 008CA062, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,008B3AF8), ref: 008CA09D

Strings

.z`, xrefs: 008CA08C, 008CA098

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: b1c7953897f55e1afc74185010513ea4f08e820175d8a43248f3489de861c21e
Instruction ID: 5c427bc85571994a30ae7dc479d8dbcb27cbeb64e3aba7f6c3311894d9fd54f1
Opcode Fuzzy Hash: b1c7953897f55e1afc74185010513ea4f08e820175d8a43248f3489de861c21e
Instruction Fuzzy Hash: 76E06DB5200618AFCB18DF68CC49EEB7768EF88350F128658FD099B242D631E8058BB0

Uniqueness

Uniqueness Score: -1.00%

Function 008CA070, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,008B3AF8), ref: 008CA09D

Strings

.z`, xrefs: 008CA08C, 008CA098

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: aee0afada11d79e9f85d581866254809ae557e91c5f6b422e0535c020d2bef25
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: CDE04FB12002086BD718DF59CC45EA777ACEF88750F018558FD1857241C630F914CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 008B8373, Relevance: 3.2, APIs: 2, Instructions: 173threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008B834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008B836B

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 6ef531ff1666c455610c41a7cb0699f63bd72561faff8bd283c1852d331b7f79
Instruction ID: 8ee6a75f8e02e6c3c0bbe835cad7ce15efe4c9045c94262ddad24af67a819f62
Opcode Fuzzy Hash: 6ef531ff1666c455610c41a7cb0699f63bd72561faff8bd283c1852d331b7f79
Instruction Fuzzy Hash: 6E515DB150020AAFDB24DF68D88ABEA77BCFB48304F10446DE559D7341DB70A941CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 008B82E8, Relevance: 3.1, APIs: 2, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008B834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008B836B

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 30edc662d8030a8ca89edfcd5193291106e323730a54800ea145d476c14bce7c
Instruction ID: 57eddd30ec1ebe1788d943f77fe573755a82f39cd1d9502455d8bf743bbfb16c
Opcode Fuzzy Hash: 30edc662d8030a8ca89edfcd5193291106e323730a54800ea145d476c14bce7c
Instruction Fuzzy Hash: A901B131A806287BE724A6989C43FFE766CFB40B51F054158FB04FA2C1E6A4690646E6

Uniqueness

Uniqueness Score: -1.00%

Function 008B82F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 008B834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 008B836B

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 044c298a1d06f307a8119cdef661a26d78d53576b52967b50bafe86328bcddef
Instruction ID: 169faf0434a72b1160803404ab1b1effec1198bf47fc3c77dbe3153afda314d8
Opcode Fuzzy Hash: 044c298a1d06f307a8119cdef661a26d78d53576b52967b50bafe86328bcddef
Instruction Fuzzy Hash: 74018431A802287AE724A6989C43FFE766CFB40F51F054158FB04FA2C1E6A4690646E6

Uniqueness

Uniqueness Score: -1.00%

Function 008CA0A2, Relevance: 1.6, APIs: 1, Instructions: 57processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 008CA134

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: eeb733b673eb944792bb8203ce0059dad5fa0bea96ffefd192fb4c38d438d47b
Instruction ID: fe7f751eac83b4065289e0668153c4bd288262f9fa0d1888aaa729a938b8d3cf
Opcode Fuzzy Hash: eeb733b673eb944792bb8203ce0059dad5fa0bea96ffefd192fb4c38d438d47b
Instruction Fuzzy Hash: 231132B2200508ABDB18DF98DC81EEB77BDEF8C354F158259FA1DE7241D230E8018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008BACD0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 008BAD42

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: a4ab077fb3f93e64a0346d34e8148d7b9c3b580d6096142c0af90af4724749c3
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: D1014CB5D0020DABDB14DAA4DC42FDEB778EB14308F004198E908D7241F631EB088B92

Uniqueness

Uniqueness Score: -1.00%

Function 008CA0E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 008CA134

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: ac01fd06b1b54cd2569403305c63171d688c29fcb748491cc78b55085f4ea429
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 5301AFB2210108ABCB58DF89DC81EEB77ADAF8C754F158258BA0DA7241C630E851CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 008CA0DD, Relevance: 1.5, APIs: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 008CA134

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: c3baa7fce7eb0ddf96255bdb43803452beb079bc69f78de0a9226d8995cc93b8
Instruction ID: 5c8b10c8ea1d56e594e1fa81c2b7fcb00460c8776b57a06dbb2a09c15379c45e
Opcode Fuzzy Hash: c3baa7fce7eb0ddf96255bdb43803452beb079bc69f78de0a9226d8995cc93b8
Instruction Fuzzy Hash: 4201A4B6210108AFCB54CF89DD81EEB37AEEF8C754F158248FA0DA7250C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008CA1C2, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,008BF1A2,008BF1A2,?,00000000,?,?), ref: 008CA200

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 03383e93dc204d9f82c5963dd4e0669818d90e0579aa9ebb9d57120db0d9273a
Instruction ID: 9e615af53c2997428e9c17b44d42d8913f66969c6b3da45f3d2ef5af421fbcab
Opcode Fuzzy Hash: 03383e93dc204d9f82c5963dd4e0669818d90e0579aa9ebb9d57120db0d9273a
Instruction Fuzzy Hash: 44F0E5B16002186FCB24DF64CC41EDB3B69EF45350F068298FE596B282C630E815CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 008CA030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(008C4506,?,008C4C7F,008C4C7F,?,008C4506,?,?,?,?,?,00000000,00000000,?), ref: 008CA05D

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: b8776514e12d7019e8397db72cb35c21ae1fea878acd3857240d9c0d76b3768f
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: A1E01AB1200208ABD714DF59CC41EA777ACEF88654F118558BA185B241C530F9148AB1

Uniqueness

Uniqueness Score: -1.00%

Function 008CA1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,008BF1A2,008BF1A2,?,00000000,?,?), ref: 008CA200

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 2c3331fdb668fee0cb439c044e924b9dd3b80bbd3e450b70925e0cd0d9e463f3
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 74E01AB12002086BDB14DF49CC85EE737ADEF88650F018154BA0867241C930E8148BF5

Uniqueness

Uniqueness Score: -1.00%

Function 008BF6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,008B8CF4,?), ref: 008BF6CB

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 705230d0bfcb3e78f2916d0cec04ef066d1bb08649047d80821d940240934143
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 08D0A7717903043BE610FAA89C03F6633DDBB55B10F490074FA48D73C3D960E4004165

Uniqueness

Uniqueness Score: -1.00%

Function 008BF699, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,008B8CF4,?), ref: 008BF6CB

Memory Dump Source

Source File: 0000000A.00000002.478037976.00000000008B0000.00000040.00000001.sdmp, Offset: 008B0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: bffc28570ab66b8dc48e1db69201ad8618277f1ff8908e152a135418ff1d6e10
Instruction ID: 322b3b5b673bf2c5c16980110710a778f61cf112cb2ed2f559d0a15a0837a30e
Opcode Fuzzy Hash: bffc28570ab66b8dc48e1db69201ad8618277f1ff8908e152a135418ff1d6e10
Instruction Fuzzy Hash: 9CB012313C40178EE943C6E09C00A693742FBF56107324076D69CCB7A1D93341070604

Uniqueness

Uniqueness Score: -1.00%

Function 04A0967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A09694

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 284f02c8ae3bddb10a69414161d978cbe1f8174ac5d0bf5c6bb6b9e51a420f61
Instruction ID: 4a185f439efa7b86b35ae46590d2038237dad7a0142fa179e6d7516e4653bb1e
Opcode Fuzzy Hash: 284f02c8ae3bddb10a69414161d978cbe1f8174ac5d0bf5c6bb6b9e51a420f61
Instruction Fuzzy Hash: 80B092B29024D5CAFB11EBB05A08B2B7E04BBD0745F26C562E2020686B4778E091F6B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04A7B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** then kb to get the faulting stack, xrefs: 04A7B51C
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 04A7B53F
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 04A7B39B
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 04A7B47D
*** An Access Violation occurred in %ws:%s, xrefs: 04A7B48F
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 04A7B305
The resource is owned exclusively by thread %p, xrefs: 04A7B374
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 04A7B38F
Go determine why that thread has not released the critical section., xrefs: 04A7B3C5
*** Resource timeout (%p) in %ws:%s, xrefs: 04A7B352
The resource is owned shared by %d threads, xrefs: 04A7B37E
read from, xrefs: 04A7B4AD, 04A7B4B2
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 04A7B2DC
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 04A7B476
The instruction at %p tried to %s , xrefs: 04A7B4B6
a NULL pointer, xrefs: 04A7B4E0
The critical section is owned by thread %p., xrefs: 04A7B3B9
write to, xrefs: 04A7B4A6
The instruction at %p referenced memory at %p., xrefs: 04A7B432
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 04A7B323
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 04A7B3D6
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 04A7B484
an invalid address, %p, xrefs: 04A7B4CF
*** enter .exr %p for the exception record, xrefs: 04A7B4F1
*** A stack buffer overrun occurred in %ws:%s, xrefs: 04A7B2F3
<unknown>, xrefs: 04A7B27E, 04A7B2D1, 04A7B350, 04A7B399, 04A7B417, 04A7B48E
This failed because of error %Ix., xrefs: 04A7B446
*** Inpage error in %ws:%s, xrefs: 04A7B418
*** enter .cxr %p for the context, xrefs: 04A7B50D
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 04A7B314

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 1d46232ca7cb4a028bc8ec7b472b9b21167001a64f61099eae36ac3eb28ef875
Instruction ID: 5e78aaff7c6fd85b3d6f335f1b3511bf37319a323c4f59a342629639b1010580
Opcode Fuzzy Hash: 1d46232ca7cb4a028bc8ec7b472b9b21167001a64f61099eae36ac3eb28ef875
Instruction Fuzzy Hash: 2081F2B5A80210FFEB356B058E49DAB3F36AF86B59F400064F5052B622E371B451DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 04A81C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04A81C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x49a48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E049CB150();
				} else {
					E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x4ab589c);
				E049CB150("Heap error detected at %p (heap handle %p)\n",  *0x4ab58a0);
				_t27 =  *0x4ab5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M04A81E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E049CB150();
				} else {
					E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E049CB150("Error code: %d - %s\n",  *0x4ab5898);
				_t113 =  *0x4ab58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E049CB150();
					} else {
						E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E049CB150("Parameter1: %p\n",  *0x4ab58a4);
				}
				_t115 =  *0x4ab58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E049CB150();
					} else {
						E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E049CB150("Parameter2: %p\n",  *0x4ab58a8);
				}
				_t117 =  *0x4ab58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E049CB150();
					} else {
						E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E049CB150("Parameter3: %p\n",  *0x4ab58ac);
				}
				_t119 =  *0x4ab58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E049CB150();
					} else {
						E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x4ab58b4);
					E049CB150("Last known valid blocks: before - %p, after - %p\n",  *0x4ab58b0);
				} else {
					_t120 =  *0x4ab58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E049CB150();
				} else {
					E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E049CB150("Stack trace available at %p\n", 0x4ab58c0);
			}

0x04a81c10
0x04a81c16
0x04a81c1e
0x04a81c3d
0x04a81c3e
0x04a81c20
0x04a81c35
0x04a81c3a
0x04a81c44
0x04a81c55
0x04a81c5a
0x04a81c65
0x04a81c67
0x00000000
0x04a81c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04a81c67
0x04a81cdc
0x04a81ce5
0x04a81d04
0x04a81d05
0x04a81ce7
0x04a81cfc
0x04a81d01
0x04a81d0b
0x04a81d17
0x04a81d1f
0x04a81d25
0x04a81d30
0x04a81d4f
0x04a81d50
0x04a81d32
0x04a81d47
0x04a81d4c
0x04a81d61
0x04a81d67
0x04a81d68
0x04a81d6e
0x04a81d79
0x04a81d98
0x04a81d99
0x04a81d7b
0x04a81d90
0x04a81d95
0x04a81daa
0x04a81db0
0x04a81db1
0x04a81db7
0x04a81dc2
0x04a81de1
0x04a81de2
0x04a81dc4
0x04a81dd9
0x04a81dde
0x04a81df3
0x04a81df9
0x04a81dfa
0x04a81e00
0x04a81e0a
0x04a81e13
0x04a81e32
0x04a81e33
0x04a81e15
0x04a81e2a
0x04a81e2f
0x04a81e39
0x04a81e4a
0x04a81e02
0x04a81e02
0x04a81e08
0x00000000
0x00000000
0x04a81e08
0x04a81e5b
0x04a81e7a
0x04a81e7b
0x04a81e5d
0x04a81e72
0x04a81e77
0x04a81e95

Strings

heap_failure_internal, xrefs: 04A81C6E
Heap error detected at %p (heap handle %p), xrefs: 04A81C50
Last known valid blocks: before - %p, after - %p, xrefs: 04A81E45
Error code: %d - %s, xrefs: 04A81D12
heap_failure_buffer_overrun, xrefs: 04A81C98
heap_failure_generic, xrefs: 04A81C7C
heap_failure_unknown, xrefs: 04A81C75
heap_failure_entry_corruption, xrefs: 04A81C83
heap_failure_buffer_underrun, xrefs: 04A81C9F
HEAP[%wZ]: , xrefs: 04A81C30, 04A81CF7, 04A81D42, 04A81D8B, 04A81DD4, 04A81E25, 04A81E6D
heap_failure_lfh_bitmap_mismatch, xrefs: 04A81CD7
heap_failure_usage_after_free, xrefs: 04A81CBB
heap_failure_multiple_entries_corruption, xrefs: 04A81C8A
Stack trace available at %p, xrefs: 04A81E86
heap_failure_listentry_corruption, xrefs: 04A81CD0
heap_failure_freelists_corruption, xrefs: 04A81CC9
Parameter3: %p, xrefs: 04A81DEE
Parameter1: %p, xrefs: 04A81D5C
heap_failure_invalid_allocation_type, xrefs: 04A81CB4
Parameter2: %p, xrefs: 04A81DA5
HEAP: , xrefs: 04A81C16, 04A81C3D, 04A81D04, 04A81D4F, 04A81D98, 04A81DE1, 04A81E32, 04A81E7A
heap_failure_cross_heap_operation, xrefs: 04A81CC2
heap_failure_virtual_block_corruption, xrefs: 04A81C91
heap_failure_invalid_argument, xrefs: 04A81CAD
heap_failure_block_not_busy, xrefs: 04A81CA6

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 2f2c020f0ae98c5243a564b28bb7b813f1a32871034876390adad25d24661536
Instruction ID: 626c8213acc0f14f8b56c2528975a0087ce4336be8bbea5cd9d0705316413409
Opcode Fuzzy Hash: 2f2c020f0ae98c5243a564b28bb7b813f1a32871034876390adad25d24661536
Instruction Fuzzy Hash: FF61E432A10244DFEA11BB84E585EB073F8EB54A34B09843EF44A5B311E674FC529F8A

Uniqueness

Uniqueness Score: -1.00%

Function 049D3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E049D3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E049D1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E049D1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E049D1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E049D1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E049D1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L049E4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E04A0F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E04A11370(_t276, 0x49a4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E04A0BB40(0,  &_v68, _t170);
									if(L049D43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E04A0BB40(_t257,  &_v68, _t243);
								if(L049D43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E04A11370(_t278, 0x49a4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L049E4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E04A0F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E04A11370(_v16, 0x49a4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E04A0BB40(_t262,  &_v68, _t244);
								if(L049D43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E04A11370(_t282, 0x49a4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E04A0BB40(_t262,  &_v68, _t201);
							if(L049D43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L049E4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E04A0F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E04A11370(_t280, 0x49a4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E04A0BB40(_t267,  &_v68, _t245);
							if(L049D43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E04A11370(_t284, 0x49a4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E04A0BB40(_t267,  &_v68, _t224);
						if(L049D43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x049d3d3c
0x049d3d42
0x049d3d44
0x049d3d46
0x049d3d49
0x049d3d4c
0x049d3d4f
0x049d3d52
0x049d3d55
0x049d3d58
0x049d3d5b
0x049d3d5f
0x049d3d61
0x049d3d66
0x04a28213
0x04a28218
0x049d4085
0x049d4088
0x049d408e
0x049d4094
0x049d409a
0x049d40a0
0x049d40a6
0x049d40a9
0x049d40af
0x049d40b6
0x049d40bd
0x049d40bd
0x049d3d83
0x04a2821f
0x04a28229
0x04a28238
0x04a28238
0x04a2823d
0x04a2823d
0x049d3da0
0x049d3daf
0x049d3db5
0x049d3dba
0x049d3dba
0x049d3dd4
0x049d3e94
0x049d3eab
0x049d3f6d
0x049d3f84
0x049d406b
0x049d406b
0x049d406e
0x049d406e
0x049d4070
0x049d4074
0x04a28351
0x04a28351
0x049d407a
0x049d407f
0x04a2835d
0x04a28370
0x04a28377
0x04a28379
0x04a2837c
0x04a2837c
0x04a2835d
0x00000000
0x049d407f
0x049d3f8a
0x049d3f8d
0x049d3f90
0x049d3f95
0x04a2830d
0x04a2830f
0x049d3f9b
0x049d3fac
0x049d3fae
0x049d3fb1
0x049d3fb1
0x049d3fb6
0x04a28317
0x04a2831a
0x00000000
0x049d3fbc
0x049d3fc1
0x049d3fc9
0x049d3fd7
0x049d3fda
0x049d3fdd
0x049d4021
0x049d4021
0x049d4029
0x049d4030
0x049d4044
0x049d4046
0x049d4046
0x049d4044
0x049d4049
0x04a28327
0x04a28334
0x04a28339
0x04a2833c
0x049d404f
0x049d404f
0x049d404f
0x049d4051
0x049d4056
0x049d4063
0x049d4063
0x049d4068
0x00000000
0x049d4068
0x049d3fdf
0x049d3fe2
0x049d3fe4
0x049d3fe7
0x049d3fef
0x049d4003
0x049d4005
0x049d4005
0x049d400c
0x049d4013
0x049d4016
0x049d4017
0x049d401b
0x049d401e
0x00000000
0x049d401e
0x049d3fb6
0x049d3eb1
0x049d3eb4
0x049d3eb7
0x049d3ebc
0x04a282a9
0x04a282ab
0x049d3ec2
0x049d3ed3
0x049d3ed5
0x049d3ed8
0x049d3ed8
0x049d3edd
0x04a282b3
0x04a282b6
0x00000000
0x049d3ee3
0x049d3ee8
0x049d3eed
0x049d3ef0
0x049d3ef3
0x049d3f02
0x049d3f05
0x049d3f08
0x04a282c0
0x04a282c3
0x04a282c5
0x04a282c8
0x04a282d0
0x04a282e4
0x04a282e6
0x04a282e6
0x04a282ed
0x04a282f4
0x04a282f7
0x04a282f8
0x04a282fc
0x04a282ff
0x04a282ff
0x049d3f0e
0x049d3f11
0x049d3f16
0x049d3f1d
0x049d3f31
0x04a28307
0x04a28307
0x049d3f31
0x049d3f39
0x049d3f48
0x049d3f4d
0x049d3f50
0x049d3f50
0x049d3f53
0x049d3f58
0x049d3f65
0x049d3f65
0x049d3f6a
0x00000000
0x049d3f6a
0x049d3edd
0x049d3dda
0x049d3ddd
0x049d3de0
0x049d3de5
0x04a28245
0x049d3deb
0x049d3df7
0x049d3dfc
0x049d3dfe
0x049d3e01
0x049d3e01
0x049d3e06
0x04a2824d
0x04a2824f
0x04a28254
0x00000000
0x049d3e0c
0x049d3e11
0x049d3e16
0x049d3e19
0x049d3e29
0x049d3e2c
0x049d3e2f
0x04a2825c
0x04a2825f
0x04a28261
0x04a28264
0x04a2826c
0x04a28280
0x04a28282
0x04a28282
0x04a28289
0x04a28290
0x04a28293
0x04a28294
0x04a28298
0x04a2829b
0x04a2829b
0x049d3e35
0x049d3e38
0x049d3e3d
0x049d3e44
0x049d3e58
0x04a282a3
0x04a282a3
0x049d3e58
0x049d3e60
0x049d3e6f
0x049d3e74
0x049d3e77
0x049d3e77
0x049d3e7a
0x049d3e7f
0x049d3e8c
0x049d3e8c
0x049d3e91
0x00000000
0x049d3e91

Strings

Kernel-MUI-Language-SKU, xrefs: 049D3F70
Kernel-MUI-Language-Disallowed, xrefs: 049D3E97
WindowsExcludedProcs, xrefs: 049D3D6F
Kernel-MUI-Number-Allowed, xrefs: 049D3D8C
Kernel-MUI-Language-Allowed, xrefs: 049D3DC0

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 6967d82c48c9d95dd887f1c2c9ae05a9c87fa281ca5d9b73ca2ecd6f41129149
Instruction ID: 6059ef8375153350136a10f028229a0a8018ed24de75abcdc59cd6c5f713da86
Opcode Fuzzy Hash: 6967d82c48c9d95dd887f1c2c9ae05a9c87fa281ca5d9b73ca2ecd6f41129149
Instruction Fuzzy Hash: 91F15072D00218EFDB15DFD8DA40AEEBBB9FF48750F14456AE905A7250E774AE00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 049C40E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E049C40E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E049CB150();
					} else {
						E049CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E049CB150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E049CB150(", passed to %s", _t29);
					}
					_push("\n");
					E049CB150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x4ab6378 = 1;
						asm("int3");
						 *0x4ab6378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x049c40e6
0x049c40e8
0x049c40f1
0x04a2042d
0x04a2044c
0x04a20451
0x04a2042f
0x04a20444
0x04a20449
0x04a2045d
0x04a20466
0x04a2046e
0x04a20474
0x04a20475
0x04a2047a
0x04a2048a
0x04a2048c
0x04a20493
0x04a20494
0x04a20494
0x00000000
0x04a2049b
0x00000000

Strings

HEAP: , xrefs: 04A2044C
, passed to %s, xrefs: 04A20469
HEAP[%wZ]: , xrefs: 04A2043F
Invalid heap signature for heap at %p, xrefs: 04A20458
RtlAllocateHeap, xrefs: 04A20468

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: d93e198b3c049f751ece6570c01ee8e19a89024fa846d43d637b3b2c2c9327c5
Instruction ID: c40a293050facc13206935a2d66a041d3630cff58b6a877e9afe3ed2f8b1720a
Opcode Fuzzy Hash: d93e198b3c049f751ece6570c01ee8e19a89024fa846d43d637b3b2c2c9327c5
Instruction Fuzzy Hash: 64014C322086509FE3159B6CF50EFA277A8DB81B34F1CC03DF00647682CAB4BC44D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 049F8E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E049F8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x4abd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4ab8464; // 0x74b10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4ab5780 & 0x00000003) != 0) {
							E04A45510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4ab5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E04A0B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4ab7984; // 0x2dc2ac8
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4ab8464; // 0x74b10110
					 *0x4abb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E049F9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4ab5780 & 0x00000005) != 0) {
						_push(_t49);
						E04A45510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x049f8e0f
0x049f8e16
0x049f8e19
0x049f8e1b
0x049f8e21
0x049f8e7f
0x049f8e85
0x04a39354
0x04a3936c
0x04a39371
0x04a3937b
0x04a39381
0x04a39381
0x04a3937b
0x049f8e9d
0x049f8e9d
0x049f8e29
0x049f8e2c
0x049f8e38
0x049f8e3e
0x049f8e43
0x049f8eb5
0x049f8eb9
0x04a392aa
0x04a392af
0x04a392e8
0x04a392e8
0x04a392af
0x049f8eb9
0x049f8e45
0x049f8e53
0x049f8e5b
0x049f8e5f
0x049f8e78
0x049f8e78
0x049f8e7d
0x049f8ec3
0x049f8ecd
0x049f8ed2
0x049f8ed2
0x049f8ec5
0x049f8ec5
0x00000000
0x049f8e7d
0x049f8e67
0x049f8ea4
0x04a3931a
0x00000000
0x00000000
0x04a39320
0x049f8ea4
0x049f8e70
0x04a39325
0x04a39340
0x04a39345
0x04a39345
0x049f8e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

LdrpFindDllActivationContext, xrefs: 04A39331, 04A3935D
minkernel\ntdll\ldrsnap.c, xrefs: 04A3933B, 04A39367
Querying the active activation context failed with status 0x%08lx, xrefs: 04A39357
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 04A3932A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 27db7a3160727af74a4a59724696362121cd5a5c43cbf41be8c20221b0f59484
Instruction ID: ce6acd3f7b9515b17649a23065fd3089d135c4f42d4d65d97c82f08ac21f5ba0
Opcode Fuzzy Hash: 27db7a3160727af74a4a59724696362121cd5a5c43cbf41be8c20221b0f59484
Instruction Fuzzy Hash: 8F412472F00311AFDFA5FE088C8CA7AB6ADEB40308F094579EA1857161E7B0BC8087C1

Uniqueness

Uniqueness Score: -1.00%

Function 04A849A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 04A84A4A, 04A84A5D, 04A84A5F, 04A84AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 04A84A61
HEAP[%wZ]: , xrefs: 04A84A3D, 04A84AB7
This is located in the %s field of the heap header., xrefs: 04A84AD6

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: ddc263b905dd205aed285f4702c25cc1ef9bc95fb663cade5512ee09539170f4
Instruction ID: 580dc4c6ab1cf788d3b3fa6e7a15d9f138117aabbd12b31ec4a413cde09fce5d
Opcode Fuzzy Hash: ddc263b905dd205aed285f4702c25cc1ef9bc95fb663cade5512ee09539170f4
Instruction Fuzzy Hash: D831F231200211EFD720EB58D886F67B3A8EF48724F54406DF416DF291F670B954CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 049D8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E049D8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E049D934A() != 0) {
								_t159 = E04A4A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4ab5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E04A45510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4ab5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E049D849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E049D8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E049D8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4ab5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4ab5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E049E2280(_t92, 0x4ab86cc);
															_t94 = E04A99DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E049F61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4ab5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E049D8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4ab5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4ab5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E04A0F380(_t136, 0x49a1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E049E2280(_t108, 0x4ab86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E049F61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E04A99D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E049DFFB0(_t118, _t156, 0x4ab86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E04A09A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x049d8799
0x049d879d
0x049d87a1
0x049d87a3
0x049d87a8
0x049d87c3
0x049d87c3
0x049d87c8
0x049d87d1
0x049d87d4
0x049d87d8
0x049d87e5
0x049d87ec
0x04a29bfe
0x04a29c00
0x04a29c02
0x04a29c08
0x04a29c0d
0x04a29c0f
0x04a29c14
0x04a29c2d
0x04a29c32
0x04a29c37
0x04a29c3a
0x04a29c3c
0x04a29c42
0x04a29c42
0x04a29c3c
0x04a29c02
0x049d87da
0x049d87df
0x049d87e3
0x00000000
0x00000000
0x049d87e3
0x049d87f2
0x00000000
0x049d87fb
0x049d87fd
0x049d87fe
0x049d880e
0x049d880f
0x049d8810
0x049d8814
0x049d881a
0x049d881c
0x049d881f
0x049d8821
0x049d8822
0x049d8824
0x049d8826
0x049d882c
0x049d882e
0x04a29c48
0x04a29c48
0x049d8834
0x049d8834
0x049d8837
0x00000000
0x00000000
0x049d8837
0x049d882e
0x049d883d
0x049d8840
0x049d8843
0x049d8846
0x049d8849
0x049d884c
0x049d884e
0x049d8850
0x049d8852
0x049d8854
0x049d8857
0x049d88b4
0x049d88b6
0x049d88b6
0x049d8859
0x049d8859
0x049d8859
0x049d8861
0x049d8866
0x049d886a
0x049d893d
0x049d8941
0x00000000
0x049d8947
0x049d8947
0x049d894a
0x049d894c
0x00000000
0x049d8952
0x049d8955
0x049d895a
0x049d895d
0x049d895d
0x049d895f
0x049d8961
0x049d8961
0x049d8968
0x00000000
0x00000000
0x049d896a
0x049d896b
0x049d896e
0x00000000
0x049d8970
0x049d8970
0x049d8970
0x049d8970
0x049d8972
0x049d8972
0x049d8974
0x00000000
0x049d897a
0x049d897a
0x049d897d
0x00000000
0x049d8983
0x04a29c65
0x04a29c6d
0x04a29c72
0x04a29c75
0x04a29c75
0x04a29c82
0x04a29c86
0x04a29c87
0x04a29c88
0x04a29c89
0x04a29c8c
0x04a29c90
0x04a29c95
0x04a29c97
0x04a29ca0
0x04a29ca3
0x04a29ca9
0x04a29ca9
0x00000000
0x04a29ca9
0x04a29ca3
0x00000000
0x04a29c97
0x049d897d
0x00000000
0x049d8974
0x049d8988
0x049d8992
0x049d8996
0x00000000
0x049d8996
0x049d894c
0x00000000
0x049d8870
0x049d887b
0x049d887d
0x049d887f
0x049d8881
0x049d8884
0x049d8884
0x049d8886
0x049d8889
0x049d888c
0x049d888e
0x049d8891
0x049d8891
0x049d8898
0x00000000
0x00000000
0x049d889a
0x049d889b
0x049d889e
0x00000000
0x00000000
0x049d88a0
0x049d88a8
0x049d88b0
0x049d88b2
0x049d88d3
0x049d88d5
0x00000000
0x049d88d7
0x049d88db
0x049d88dc
0x049d88e0
0x049d88e8
0x049d88ee
0x049d88f0
0x049d88f3
0x049d88fc
0x049d8901
0x049d8906
0x049d890c
0x049d890c
0x049d890f
0x049d8916
0x049d8917
0x049d8918
0x049d8919
0x049d891a
0x049d891f
0x049d8921
0x04a29c52
0x04a29c55
0x04a29c5b
0x04a29cac
0x04a29cc0
0x04a29cc0
0x04a29c55
0x049d8927
0x049d8927
0x049d892f
0x049d8933
0x00000000
0x049d88f5
0x049d88f5
0x00000000
0x049d88f7
0x049d88f7
0x049d88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x049d88fa
0x049d88f5
0x049d88f3
0x00000000
0x049d88d5
0x00000000
0x049d88b2
0x049d88c9
0x00000000
0x049d88c9
0x049d887f
0x049d886a
0x049d8857
0x049d8852
0x049d88bf
0x049d88bf
0x049d87aa
0x049d87ad
0x049d87ae
0x049d87b4
0x049d87b5
0x049d87b6
0x049d87b8
0x049d87bd
0x049d87c1
0x049d87f4
0x049d87fa
0x00000000
0x00000000
0x00000000
0x049d87c1
0x00000000

Strings

LdrpDoPostSnapWork, xrefs: 04A29C1E
minkernel\ntdll\ldrsnap.c, xrefs: 04A29C28
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 04A29C18

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 9c3c3b8c04d000838664ce5f107509e2710337a2237547bb7d9a5ca025135d4d
Instruction ID: 1cad4f291dbf59ba4d1db6ccf926857f9514886fbd488c28a0a1a06d21532a50
Opcode Fuzzy Hash: 9c3c3b8c04d000838664ce5f107509e2710337a2237547bb7d9a5ca025135d4d
Instruction Fuzzy Hash: 9A91E3B1B00216AFDF18EF59C481ABA73BDFF84354B448479E965AB252E730BD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 049D7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E049D7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E049DCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E049CC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4ab5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E04A45510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4ab5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E049E7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E049E7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E04A47016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E049E7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E049E7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E04A47016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E049FA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E049CB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x049d7e4c
0x049d7e50
0x049d7e55
0x049d7e58
0x049d7e5d
0x049d7e71
0x049d7f33
0x049d7e77
0x049d7e77
0x049d7e79
0x049d7e79
0x049d7e7e
0x049d7f45
0x04a29848
0x00000000
0x04a29848
0x049d7f4e
0x049d7f53
0x049d7f5a
0x00000000
0x00000000
0x04a2985a
0x04a29862
0x04a29866
0x00000000
0x04a2986c
0x00000000
0x04a2986c
0x049d7e84
0x049d7e84
0x049d7e8d
0x04a29871
0x049d7eb8
0x049d7ec0
0x049d7ec0
0x049d7e9a
0x04a2987e
0x00000000
0x00000000
0x04a29884
0x04a2988b
0x04a298a7
0x04a298ac
0x04a298b1
0x04a298b6
0x04a298b8
0x04a298b8
0x04a298b9
0x00000000
0x04a298b9
0x049d7ea0
0x049d7ea7
0x00000000
0x00000000
0x049d7eac
0x049d7eb1
0x049d7ec6
0x049d7ed0
0x04a298cc
0x049d7ed6
0x049d7ed6
0x049d7ed6
0x049d7ede
0x049d7ee3
0x04a298e3
0x04a298f0
0x04a29902
0x04a298f2
0x04a298fb
0x04a298fb
0x04a29907
0x04a2991d
0x04a2991d
0x04a29907
0x04a298e3
0x049d7ef0
0x049d7f14
0x049d7f14
0x049d7f1e
0x04a29946
0x049d7f24
0x049d7f24
0x049d7f24
0x049d7f2c
0x04a2996a
0x04a29975
0x04a29975
0x04a2997e
0x04a29993
0x04a29993
0x04a2997e
0x00000000
0x049d7ef2
0x049d7efc
0x049d7f0a
0x049d7f0e
0x04a29933
0x00000000
0x04a29933
0x00000000
0x049d7f0e
0x00000000
0x00000000
0x00000000
0x049d7eb1

Strings

LdrpCompleteMapModule, xrefs: 04A29898
Could not validate the crypto signature for DLL %wZ, xrefs: 04A29891
minkernel\ntdll\ldrmap.c, xrefs: 04A298A2

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 1e14d069f17b2b12a0965c7bc08c281324d159b35f5974327c4bf6a115b66bb2
Instruction ID: 0dd03d3c2d7145a636248dc73f186c79190bb2c45c01c48aba2f946e06f62143
Opcode Fuzzy Hash: 1e14d069f17b2b12a0965c7bc08c281324d159b35f5974327c4bf6a115b66bb2
Instruction Fuzzy Hash: B451E271B007549BEB25CBACC948B2AB7E9AB40714F0445B9E8519B7E1D734FD00DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 049CE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E049CE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E049CF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E04A095D0();
						}
						if(_t78 != 0) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E04A0FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E04A0BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E04A09600();
					if(_t97 < 0) {
						goto L6;
					}
					E04A0BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L049CF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E04A0BB40(_t83, _t102 + 0x24, _t78);
								if(L049D43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E04A0BB40(_t84, _t102 + 0x24, _t94);
									if(L049D43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x049ce620
0x049ce628
0x049ce62f
0x049ce631
0x049ce635
0x049ce637
0x049ce63e
0x04a25503
0x04a25503
0x049ce64c
0x049ce64c
0x049ce651
0x00000000
0x00000000
0x049ce661
0x049ce665
0x04a2542a
0x049ce715
0x049ce71a
0x049ce71c
0x049ce720
0x049ce720
0x049ce727
0x049ce736
0x049ce736
0x049ce743
0x049ce743
0x049ce673
0x049ce678
0x049ce67d
0x049ce682
0x049ce685
0x049ce692
0x049ce69b
0x049ce6a3
0x049ce6ad
0x049ce6b1
0x049ce6b2
0x049ce6bb
0x049ce6bf
0x049ce6c0
0x049ce6c8
0x049ce6cc
0x049ce6d5
0x049ce6d9
0x00000000
0x00000000
0x049ce6e5
0x049ce6ea
0x049ce6f9
0x049ce70b
0x049ce70f
0x04a25439
0x04a2545e
0x04a2545e
0x00000000
0x04a2545e
0x04a2543b
0x04a2543e
0x04a25440
0x04a25445
0x04a25472
0x04a25475
0x04a2548d
0x04a25493
0x04a254a9
0x00000000
0x00000000
0x04a254ab
0x04a254b4
0x04a254bc
0x04a254c8
0x04a254de
0x04a254fb
0x04a254e0
0x04a254e6
0x04a254eb
0x04a254eb
0x04a254de
0x00000000
0x04a254bc
0x04a25477
0x04a2547a
0x04a25480
0x04a25483
0x04a25486
0x04a2548b
0x00000000
0x00000000
0x00000000
0x04a2548b
0x00000000
0x00000000
0x00000000
0x00000000
0x04a25447
0x04a25447
0x04a25447
0x04a25447
0x04a2544e
0x00000000
0x00000000
0x04a25450
0x04a25452
0x04a25455
0x04a2545a
0x00000000
0x00000000
0x00000000
0x04a2545c
0x04a2546a
0x04a2546d
0x04a2546f
0x00000000
0x04a2546f
0x049ce70f

Strings

InstallLanguageFallback, xrefs: 049CE6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 049CE68C
@, xrefs: 049CE6C0

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: aff9d373ba1c5ba04a00c74b006c7c91e013128660625856bd5080ac2447b6ab
Instruction ID: ae86f51d4a7f03bfbcf4d5ff156bfc5226d989288485dae234fb60c448ac4bc2
Opcode Fuzzy Hash: aff9d373ba1c5ba04a00c74b006c7c91e013128660625856bd5080ac2447b6ab
Instruction Fuzzy Hash: 66519171908365ABD714DF68C540A6BB3E9BF98714F05492EF985D7240F734FA04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 04A8E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E04A8E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E04A8BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E04A8BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E04A8AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E04A09730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E04A8A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E04A8A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E04A09730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E04A8A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E04A8A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E049E2280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E049DB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E049DFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E049E7D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E04A7FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x04a8e547
0x04a8e549
0x04a8e54f
0x04a8e553
0x04a8e557
0x04a8e55a
0x04a8e55c
0x04a8e55f
0x04a8e561
0x04a8e567
0x04a8e56b
0x04a8e7e2
0x00000000
0x04a8e571
0x04a8e575
0x04a8e577
0x04a8e57b
0x04a8e57c
0x04a8e57d
0x04a8e57e
0x04a8e57f
0x04a8e588
0x04a8e58f
0x04a8e591
0x04a8e592
0x04a8e592
0x04a8e596
0x04a8e59e
0x04a8e5a0
0x04a8e5a6
0x04a8e61d
0x04a8e61d
0x04a8e621
0x04a8e623
0x04a8e630
0x04a8e630
0x04a8e7e6
0x04a8e7eb
0x04a8e7ed
0x04a8e7f4
0x04a8e7fa
0x04a8e7ff
0x04a8e7ff
0x04a8e80a
0x04a8e812
0x04a8e812
0x04a8e5ab
0x04a8e5b4
0x04a8e5b9
0x04a8e5be
0x04a8e5c0
0x04a8e5c2
0x04a8e5c8
0x04a8e5c9
0x04a8e5cb
0x04a8e5cc
0x04a8e5d5
0x04a8e5e4
0x04a8e5f1
0x04a8e5f8
0x04a8e5f8
0x04a8e5d5
0x04a8e602
0x04a8e616
0x04a8e63d
0x04a8e644
0x04a8e64d
0x04a8e652
0x04a8e657
0x04a8e659
0x04a8e65b
0x04a8e661
0x04a8e662
0x04a8e664
0x04a8e665
0x04a8e66e
0x04a8e67d
0x04a8e68a
0x04a8e691
0x04a8e691
0x04a8e66e
0x04a8e6b0
0x00000000
0x04a8e6b6
0x04a8e6bd
0x04a8e6c7
0x04a8e6d7
0x04a8e6d9
0x04a8e6db
0x04a8e6de
0x04a8e6e3
0x04a8e6f3
0x04a8e6fc
0x04a8e700
0x04a8e700
0x04a8e704
0x04a8e70a
0x04a8e70a
0x04a8e713
0x04a8e716
0x04a8e719
0x04a8e720
0x04a8e761
0x04a8e76b
0x04a8e774
0x04a8e77a
0x04a8e77a
0x04a8e78a
0x04a8e791
0x04a8e799
0x04a8e79b
0x04a8e79f
0x04a8e7aa
0x04a8e7c0
0x04a8e7ac
0x04a8e7b2
0x04a8e7b9
0x04a8e7b9
0x04a8e7c7
0x04a8e806
0x00000000
0x04a8e7c9
0x04a8e7d1
0x04a8e7d8
0x00000000
0x04a8e7d8
0x00000000
0x00000000
0x04a8e722
0x04a8e72e
0x04a8e748
0x04a8e74c
0x04a8e754
0x04a8e756
0x04a8e75c
0x04a8e75c
0x00000000
0x04a8e75c
0x04a8e758
0x04a8e758
0x00000000
0x04a8e758
0x04a8e750
0x00000000
0x00000000
0x04a8e752
0x00000000
0x04a8e752
0x04a8e730
0x04a8e735
0x04a8e73d
0x04a8e73f
0x00000000
0x00000000
0x04a8e741
0x04a8e741
0x00000000
0x04a8e741
0x04a8e739
0x00000000
0x00000000
0x04a8e73b
0x00000000
0x04a8e73b
0x04a8e722
0x04a8e720
0x04a8e6b0
0x04a8e618
0x00000000
0x04a8e618

Strings

`, xrefs: 04A8E670
`, xrefs: 04A8E5D7

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: cbe257c3fbe41c350490349740afdc8099b085d536d6487fc8e481e7f40112c3
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: B2916B716043429FE724EF25C941B2BB7E6EF84714F14892DF9A9CA280E774F904CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04A451BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04A451BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x4aa05f0);
				E04A1D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E049DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E04A453CA(0);
						return E04A1D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E04A0F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E049E3690(1, _t117, 0x49a1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E04A0AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L049E4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E04A0AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E04A4500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E04A09860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x04a451be
0x04a451c3
0x04a451c8
0x04a451cd
0x04a451d0
0x04a451d3
0x04a451d8
0x04a451db
0x04a451de
0x04a451e0
0x04a451e3
0x04a451e6
0x04a451e8
0x04a45342
0x04a45351
0x04a45356
0x04a4535a
0x04a45360
0x04a45363
0x04a45366
0x04a45369
0x04a45369
0x04a4536b
0x04a4536b
0x04a45370
0x04a453a3
0x04a453a4
0x04a453a6
0x04a453ab
0x04a453ab
0x04a453ae
0x04a453ae
0x04a453b5
0x04a453bf
0x04a453bf
0x04a45375
0x04a45396
0x04a453a0
0x04a453a0
0x00000000
0x04a45396
0x04a45377
0x04a45379
0x04a4537f
0x04a4538c
0x04a45390
0x00000000
0x04a45390
0x04a451ee
0x04a451f1
0x04a45301
0x04a45310
0x04a45315
0x04a45318
0x04a4531b
0x04a45320
0x04a4532e
0x04a45331
0x00000000
0x04a45331
0x04a45328
0x04a45329
0x00000000
0x04a45329
0x04a451fa
0x04a45235
0x04a45236
0x04a45239
0x04a4523f
0x04a45240
0x04a45241
0x04a45242
0x04a45246
0x04a45247
0x04a4524e
0x04a45251
0x04a45267
0x04a45269
0x04a4526e
0x04a4527d
0x04a4527e
0x04a45281
0x04a45282
0x04a45287
0x04a45288
0x04a4528a
0x04a4528f
0x04a45294
0x00000000
0x00000000
0x04a4529a
0x04a4529c
0x04a4529e
0x04a4529e
0x04a452a4
0x04a452b0
0x00000000
0x00000000
0x04a452ba
0x04a452bc
0x04a452bc
0x04a452d4
0x04a452d9
0x04a452dc
0x04a452e1
0x00000000
0x00000000
0x04a452e7
0x04a452f4
0x00000000
0x04a452f4
0x04a45270
0x00000000
0x04a45270
0x04a451fc
0x04a451fd
0x04a45202
0x04a45203
0x04a45205
0x04a4520a
0x04a4520f
0x00000000
0x00000000
0x04a4521b
0x04a45226
0x04a4522b
0x04a4521d
0x04a4521d
0x04a45222
0x04a45222
0x04a4522d
0x00000000

Strings

Legacy, xrefs: 04A45226
UEFI, xrefs: 04A4521D

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 3bc7a32e103320d2bce3ddd4f2b53e03a0f1c1736af4c742b3106f8e7f0b7a90
Instruction ID: 7303710dbe59ee18f58829cc6228e88bd8a233eb91eb21dae88da5f00dea9cf0
Opcode Fuzzy Hash: 3bc7a32e103320d2bce3ddd4f2b53e03a0f1c1736af4c742b3106f8e7f0b7a90
Instruction Fuzzy Hash: 8A514C71E00609AFDB24DFA8C950AAEB7F8BFC8704F54406DE649EB291D671F900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 049EB944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E049EB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x4abd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E049E7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E04A98CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E04A09E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E04A0B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E04A0CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E049E7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E04A98F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E04A0AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4ab8628; // 0x0
								_v68 = _t77;
								_t78 =  *0x4ab862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4ab8628; // 0x0
							_t116 =  *0x4ab862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x049eb94c
0x049eb956
0x049eb95c
0x049eb95e
0x049eb964
0x049eb969
0x049eb96d
0x049eb96d
0x049eb970
0x049eb974
0x049eb97a
0x049ebadf
0x049ebadf
0x049ebae2
0x049ebae4
0x049ebae6
0x049ebaf0
0x04a32cb8
0x049ebaf6
0x049ebaf6
0x049ebaf6
0x049ebafd
0x049ebb1f
0x049ebb1f
0x049ebaff
0x049ebb00
0x049ebb00
0x049ebb03
0x049ebb03
0x049ebacb
0x049ebacf
0x049ebad0
0x049ebad1
0x049ebadc
0x049ebadc
0x049eb980
0x049eb980
0x049eb988
0x049eb98b
0x049eb98d
0x049eb990
0x049eb993
0x049eb999
0x049eb99b
0x049eb9a1
0x049eb9a5
0x049eb9aa
0x049eb9b0
0x049eb9bb
0x049eb9c0
0x049eb9c3
0x049eb9ca
0x049eb9cc
0x049eb9cf
0x049eb9d3
0x049eb9d7
0x049eba94
0x049eba94
0x049eba98
0x049ebaa3
0x04a32ccb
0x049ebaa9
0x049ebaa9
0x049ebaa9
0x049ebab1
0x04a32cd5
0x04a32cdd
0x04a32cdd
0x049ebabb
0x049ebabc
0x049ebac2
0x049ebac3
0x049ebac3
0x049ebac6
0x00000000
0x049eb9dd
0x049eb9dd
0x049eb9e7
0x049eb9e7
0x049eb9ec
0x049eb9ec
0x049eb9f1
0x049eb9f5
0x049eb9fa
0x049eba00
0x049eba0c
0x049eba10
0x049eba10
0x049eba12
0x049eba18
0x00000000
0x00000000
0x049ebb26
0x049ebb26
0x049eba1e
0x049eba1e
0x049eba23
0x049eba25
0x049eba2c
0x049eba30
0x049eba35
0x049eba35
0x049eba41
0x049eba46
0x049eba4c
0x049eba50
0x049eba54
0x049eba6a
0x049eba6e
0x049eba70
0x049eba74
0x049eba78
0x049eba7a
0x049eba7c
0x049eba8e
0x049eba90
0x049eba92
0x049ebb14
0x049ebb14
0x049ebb16
0x049ebb16
0x00000000
0x049eba7c
0x049ebb0a
0x049ebb0d
0x00000000
0x00000000
0x00000000
0x049ebb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 049EB9A5

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: d8b611d053d34145b4b2fc84fbbd72b5efc100abf41f87e5d03b939a0f0b2a1b
Instruction ID: 8d8b0b4556eb7c016751220e0bc2e6a31223707eb8e7976821b73873c7bc9878
Opcode Fuzzy Hash: d8b611d053d34145b4b2fc84fbbd72b5efc100abf41f87e5d03b939a0f0b2a1b
Instruction Fuzzy Hash: 41513A71608341CFCB21DF2AC59092ABBE9FB88714F24896EF68597355E730F844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 049CB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E049CB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x4a9f7a8);
				E04A1D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E04A1D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E04A0D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E04A0F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L04A1DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E04A0B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E04A0B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E04A0E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E04A0A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x049cb171
0x049cb171
0x049cb171
0x049cb171
0x049cb171
0x049cb176
0x049cb17b
0x049cb180
0x049cb186
0x049cb18f
0x049cb198
0x049cb1a4
0x049cb1aa
0x04a24802
0x04a24802
0x04a24805
0x04a2480c
0x04a2480e
0x049cb1d1
0x049cb1d3
0x049cb1de
0x049cb1de
0x04a24817
0x04a2481e
0x04a24820
0x04a24822
0x04a24822
0x04a24824
0x04a24824
0x04a2482a
0x00000000
0x00000000
0x04a24835
0x04a2483a
0x04a2483d
0x04a2483f
0x04a24842
0x04a24842
0x04a24842
0x04a24846
0x04a2484c
0x04a2484e
0x04a24851
0x04a24851
0x04a24853
0x04a24854
0x04a24854
0x04a24858
0x04a2485a
0x04a2485a
0x04a2485d
0x04a2485f
0x04a24861
0x04a24861
0x04a24866
0x04a2486b
0x04a2486e
0x04a24871
0x04a24876
0x04a24876
0x04a24878
0x04a2487b
0x04a24884
0x04a24884
0x00000000
0x04a2487d
0x04a2487d
0x04a24882
0x04a24889
0x04a24889
0x04a2488f
0x04a24891
0x04a248e0
0x04a248e2
0x04a248e4
0x04a248e4
0x04a248e7
0x04a248e7
0x04a248ed
0x04a248f4
0x04a248f6
0x04a24951
0x04a24951
0x04a24953
0x04a24953
0x04a24956
0x04a24956
0x04a24958
0x04a24959
0x04a24959
0x04a2495d
0x04a2495d
0x04a2495f
0x04a2495f
0x04a24965
0x04a24969
0x04a249ba
0x04a249ba
0x04a249c1
0x04a249c5
0x04a249cc
0x04a249d4
0x04a249d7
0x04a249da
0x04a249e4
0x04a249e5
0x04a249f3
0x04a24a02
0x00000000
0x04a24a02
0x04a24972
0x04a24974
0x00000000
0x00000000
0x04a24976
0x04a24979
0x04a24982
0x04a24983
0x04a24984
0x04a2498b
0x04a2498d
0x04a24991
0x04a24993
0x04a24999
0x04a2499d
0x04a249a2
0x04a249a2
0x04a249a2
0x04a24999
0x04a249ac
0x00000000
0x04a249b3
0x04a248f8
0x04a248fe
0x00000000
0x00000000
0x00000000
0x04a248fe
0x04a24895
0x04a2489c
0x04a248ad
0x04a248b2
0x04a248b5
0x04a248b7
0x04a248ba
0x04a248bc
0x04a248c6
0x04a248c6
0x04a248cb
0x04a248d1
0x04a248d4
0x04a248d8
0x04a248d8
0x00000000
0x04a248d8
0x04a248be
0x04a248c0
0x00000000
0x00000000
0x04a248c2
0x00000000
0x00000000
0x00000000
0x04a248c4
0x00000000
0x04a24882
0x04a2487b
0x04a24904
0x04a24906
0x00000000
0x00000000
0x04a24908
0x04a2490e
0x00000000
0x00000000
0x04a24910
0x04a24917
0x04a24917
0x00000000
0x04a24917
0x049cb1ba
0x04a247f9
0x04a247fc
0x00000000
0x00000000
0x00000000
0x04a247fc
0x049cb1c0
0x049cb1c0
0x049cb1c3
0x049cb1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 04A248AD

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 46c20e8130aea6593830d6664e2c25e60798001b9e93077df35515d90c38039f
Instruction ID: ac917e1073f1564b2a1bfba0d666e7ce369470979be105e144ea77bdccc3822f
Opcode Fuzzy Hash: 46c20e8130aea6593830d6664e2c25e60798001b9e93077df35515d90c38039f
Instruction Fuzzy Hash: 9051F371D102798FEB31CF68CA40BAEBBB0AF08714F1041ADE859AB281D3706941AB91

Uniqueness

Uniqueness Score: -1.00%

Function 049F2581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E049F2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t233;
				signed int _t237;
				intOrPtr _t241;
				intOrPtr _t242;
				intOrPtr _t246;
				signed int _t250;
				signed int _t252;
				intOrPtr _t254;
				signed int _t257;
				signed int _t264;
				signed int _t267;
				signed int _t275;
				signed int _t281;
				signed int _t283;
				void* _t286;
				void* _t287;
				signed int _t288;
				unsigned int _t291;
				signed int _t295;
				signed int _t297;
				signed int _t301;
				intOrPtr _t313;
				signed int _t322;
				signed int _t324;
				signed int _t325;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t334;
				signed int _t336;
				void* _t337;
				void* _t339;
				void* _t340;

				_t334 = _t336;
				_t337 = _t336 - 0x4c;
				_v8 =  *0x4abd360 ^ _t334;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t329 = 0x4abb2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t291 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t340 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t281 = 0x48;
				_t311 = 0 | _t340 == 0x00000000;
				_t322 = 0;
				_v37 = _t340 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t281 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t330 = 0xc0000106;
						goto L32;
					} else {
						_t329 = L049E4620(_t291,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t281);
						_v52 = _t329;
						__eflags = _t329;
						if(_t329 == 0) {
							_t330 = 0xc0000017;
							goto L32;
						} else {
							 *(_t329 + 0x44) =  *(_t329 + 0x44) & 0x00000000;
							_t50 = _t329 + 0x48; // 0x48
							_t324 = _t50;
							_t311 = _v32;
							 *(_t329 + 0x3c) = _t281;
							_t283 = 0;
							 *((short*)(_t329 + 0x30)) = _v48;
							__eflags = _t311;
							if(_t311 != 0) {
								 *(_t329 + 0x18) = _t324;
								__eflags = _t311 - 0x4ab8478;
								 *_t329 = ((0 | _t311 == 0x04ab8478) - 0x00000001 & 0xfffffffb) + 7;
								E04A0F3E0(_t324,  *((intOrPtr*)(_t311 + 4)),  *_t311 & 0x0000ffff);
								_t311 = _v32;
								_t337 = _t337 + 0xc;
								_t283 = 1;
								__eflags = _a8;
								_t324 = _t324 + (( *_t311 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t275 = E04A539F2(_t324);
									_t311 = _v32;
									_t324 = _t275;
								}
							}
							_t295 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t330 = _v68;
								__eflags = 0;
								 *((short*)(_t324 - 2)) = 0;
								goto L32;
							} else {
								_t281 = _t329 + _t283 * 4;
								_v56 = _t281;
								do {
									__eflags = _t311;
									if(_t311 != 0) {
										_t233 =  *(_v60 + _t295 * 4);
										__eflags = _t233;
										if(_t233 == 0) {
											goto L30;
										} else {
											__eflags = _t233 == 5;
											if(_t233 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t281 =  *(_v60 + _t295 * 4);
										 *(_t281 + 0x18) = _t324;
										_t237 =  *(_v60 + _t295 * 4);
										__eflags = _t237 - 8;
										if(_t237 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t237 * 4 +  &M049F2959))) {
												case 0:
													__ax =  *0x4ab8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E04A0F3E0(__edi,  *0x4ab848c, __ax & 0x0000ffff);
														__eax =  *0x4ab8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E04A0F3E0(_t324, _v80, _v64);
													_t270 = _v64;
													goto L26;
												case 2:
													 *0x4ab8480 & 0x0000ffff = E04A0F3E0(__edi,  *0x4ab8484,  *0x4ab8480 & 0x0000ffff);
													__eax =  *0x4ab8480 & 0x0000ffff;
													__eax = ( *0x4ab8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E04A0F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E04A0F3E0(_t324, _v76, _v36);
														_t270 = _v36;
													}
													L26:
													_t337 = _t337 + 0xc;
													_t324 = _t324 + (_t270 >> 1) * 2 + 2;
													__eflags = _t324;
													L27:
													_push(0x3b);
													_pop(_t272);
													 *((short*)(_t324 - 2)) = _t272;
													goto L28;
												case 6:
													__ebx =  *0x4ab575c;
													__eflags = __ebx - 0x4ab575c;
													if(__ebx != 0x4ab575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E04A0F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x4ab575c;
														} while (__ebx != 0x4ab575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4ab8478 & 0x0000ffff = E04A0F3E0(__edi,  *0x4ab847c,  *0x4ab8478 & 0x0000ffff);
													__eax =  *0x4ab8478 & 0x0000ffff;
													__eax = ( *0x4ab8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E04A539F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4ab6e58 & 0x0000ffff = E04A0F3E0(__edi,  *0x4ab6e5c,  *0x4ab6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4ab6e58 & 0x0000ffff;
													__eax = ( *0x4ab6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t295 = _v16;
													_t311 = _v32;
													L29:
													_t281 = _t281 + 4;
													__eflags = _t281;
													_v56 = _t281;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t295 = _t295 + 1;
									_v16 = _t295;
									__eflags = _t295 - _v48;
								} while (_t295 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t237 =  *(_v60 + _t322 * 4);
						if(_t237 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t237 * 4 +  &M049F2935))) {
							case 0:
								__ax =  *0x4ab8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t311 =  &_v64;
								_v80 = E049F2E3E(0,  &_v64);
								_t281 = _t281 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4ab8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4ab8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E049DEEF0(0x4ab79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E049DEB70(__ecx, 0x4ab79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t211 = _v72;
											__eflags = _t211;
											if(_t211 != 0) {
												L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t211);
											}
											_t212 = _v52;
											__eflags = _t212;
											if(_t212 != 0) {
												__eflags = _t330;
												if(_t330 < 0) {
													L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t212);
													_t212 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t291 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4ab7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E049DEB70(__ecx, 0x4ab79a0);
										__eax = _v52;
										L36:
										_pop(_t323);
										_pop(_t331);
										__eflags = _v8 ^ _t334;
										_pop(_t282);
										return E04A0B640(_t212, _t282, _v8 ^ _t334, _t311, _t323, _t331);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t277 = _v56;
								if(_v56 != 0) {
									_t311 =  &_v36;
									_t279 = E049F2E3E(_t277,  &_v36);
									_t291 = _v36;
									_v76 = _t279;
								}
								if(_t291 == 0) {
									goto L44;
								} else {
									_t281 = _t281 + 2 + _t291;
								}
								goto L14;
							case 6:
								__eax =  *0x4ab5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4ab8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4ab8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4ab6e58 & 0x0000ffff;
								__eax = ( *0x4ab6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t322 = _t322 + 1;
								if(_t322 >= _v48) {
									goto L16;
								} else {
									_t311 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					asm("int 0x29");
					asm("out 0x28, al");
					asm("lahf");
					 *((intOrPtr*)(_t324 - 0x60d81ffc)) =  *((intOrPtr*)(_t324 - 0x60d81ffc)) - _t281;
					asm("lahf");
					 *((intOrPtr*)(_t324 - 0x60d9fafc)) =  *((intOrPtr*)(_t324 - 0x60d9fafc)) - _t281;
					_t241 = _t237 + 0xf9;
					 *0x9f289404 = _t241;
					_t242 = _t241 + 0x35;
					_t286 = 0x25;
					 *0x9f290204 = _t242;
					 *((intOrPtr*)(_t324 - 0x60d809fc)) =  *((intOrPtr*)(_t324 - 0x60d809fc)) - _t286;
					 *((intOrPtr*)(_t324 - 0x60d7b1fc)) =  *((intOrPtr*)(_t324 - 0x60d7b1fc)) - _t286;
					asm("daa");
					asm("lahf");
					_t246 = _t242 + 0x1d3;
					_pop(_t287);
					 *0x9f28b404 = _t246;
					_pop(_t339);
					 *0xcccccc04 = _t246 + 0x34;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x4a9ff00);
					E04A1D08C(_t287, _t324, _t329);
					_v44 =  *[fs:0x18];
					_t325 = 0;
					 *_a24 = 0;
					_t288 = _a12;
					__eflags = _t288;
					if(_t288 == 0) {
						_t250 = 0xc0000100;
					} else {
						_v8 = 0;
						_t332 = 0xc0000100;
						_v52 = 0xc0000100;
						_t252 = 4;
						while(1) {
							_v40 = _t252;
							__eflags = _t252;
							if(_t252 == 0) {
								break;
							}
							_t301 = _t252 * 0xc;
							_v48 = _t301;
							__eflags = _t288 -  *((intOrPtr*)(_t301 + 0x49a1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t267 = E04A0E5C0(_a8,  *((intOrPtr*)(_t301 + 0x49a1668)), _t288);
									_t339 = _t339 + 0xc;
									__eflags = _t267;
									if(__eflags == 0) {
										_t332 = E04A451BE(_t288,  *((intOrPtr*)(_v48 + 0x49a166c)), _a16, _t325, _t332, __eflags, _a20, _a24);
										_v52 = _t332;
										break;
									} else {
										_t252 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t252 = _t252 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t332;
						__eflags = _t332;
						if(_t332 < 0) {
							__eflags = _t332 - 0xc0000100;
							if(_t332 == 0xc0000100) {
								_t297 = _a4;
								__eflags = _t297;
								if(_t297 != 0) {
									_v36 = _t297;
									__eflags =  *_t297 - _t325;
									if( *_t297 == _t325) {
										_t332 = 0xc0000100;
										goto L76;
									} else {
										_t313 =  *((intOrPtr*)(_v44 + 0x30));
										_t254 =  *((intOrPtr*)(_t313 + 0x10));
										__eflags =  *((intOrPtr*)(_t254 + 0x48)) - _t297;
										if( *((intOrPtr*)(_t254 + 0x48)) == _t297) {
											__eflags =  *(_t313 + 0x1c);
											if( *(_t313 + 0x1c) == 0) {
												L106:
												_t332 = E049F2AE4( &_v36, _a8, _t288, _a16, _a20, _a24);
												_v32 = _t332;
												__eflags = _t332 - 0xc0000100;
												if(_t332 != 0xc0000100) {
													goto L69;
												} else {
													_t325 = 1;
													_t297 = _v36;
													goto L75;
												}
											} else {
												_t257 = E049D6600( *(_t313 + 0x1c));
												__eflags = _t257;
												if(_t257 != 0) {
													goto L106;
												} else {
													_t297 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t332 = E049F2C50(_t297, _a8, _t288, _a16, _a20, _a24, _t325);
											L76:
											_v32 = _t332;
											goto L69;
										}
									}
									goto L108;
								} else {
									E049DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t332 = _a24;
									_t264 = E049F2AE4( &_v36, _a8, _t288, _a16, _a20, _t332);
									_v32 = _t264;
									__eflags = _t264 - 0xc0000100;
									if(_t264 == 0xc0000100) {
										_v32 = E049F2C50(_v36, _a8, _t288, _a16, _a20, _t332, 1);
									}
									_v8 = _t325;
									E049F2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t250 = _t332;
					}
					L70:
					return E04A1D0D1(_t250);
				}
				L108:
			}

0x049f2584
0x049f2586
0x049f2590
0x049f2596
0x049f2597
0x049f2598
0x049f2599
0x049f259e
0x049f25a4
0x049f25a9
0x049f25ac
0x049f25ae
0x049f25b1
0x049f25b2
0x049f25b5
0x049f25b8
0x049f25bb
0x049f25bc
0x049f25bf
0x049f25c2
0x049f25c5
0x049f25c6
0x049f25cb
0x049f25ce
0x049f25d8
0x049f25db
0x049f25dd
0x049f25de
0x049f25e1
0x049f25e3
0x049f25e9
0x049f26da
0x049f26da
0x049f26dd
0x049f26e2
0x04a35b56
0x00000000
0x049f26e8
0x049f26f9
0x049f26fb
0x049f26fe
0x049f2700
0x04a35b60
0x00000000
0x049f2706
0x049f2706
0x049f270a
0x049f270a
0x049f270d
0x049f2713
0x049f2716
0x049f2718
0x049f271c
0x049f271e
0x04a35b6c
0x04a35b6f
0x04a35b7f
0x04a35b89
0x04a35b8e
0x04a35b93
0x04a35b96
0x04a35b9c
0x04a35ba0
0x04a35ba3
0x04a35bab
0x04a35bb0
0x04a35bb3
0x04a35bb3
0x04a35ba3
0x049f2724
0x049f2726
0x049f2729
0x049f272c
0x049f279d
0x049f279d
0x049f27a0
0x049f27a2
0x00000000
0x049f272e
0x049f272e
0x049f2731
0x049f2734
0x049f2734
0x049f2736
0x04a35bc1
0x04a35bc1
0x04a35bc4
0x00000000
0x04a35bca
0x04a35bca
0x04a35bcd
0x00000000
0x04a35bd3
0x00000000
0x04a35bd3
0x04a35bcd
0x049f273c
0x049f273c
0x049f2742
0x049f2747
0x049f274a
0x049f274d
0x049f2750
0x00000000
0x049f2756
0x049f2756
0x00000000
0x049f2902
0x049f2908
0x049f290b
0x00000000
0x049f2911
0x049f291c
0x049f2921
0x00000000
0x049f2921
0x00000000
0x00000000
0x049f2880
0x049f2887
0x049f288c
0x00000000
0x00000000
0x049f2805
0x049f280a
0x049f2814
0x049f2816
0x00000000
0x00000000
0x049f281e
0x049f2821
0x049f2823
0x00000000
0x049f2829
0x049f2829
0x049f2831
0x049f283c
0x049f283e
0x00000000
0x049f283e
0x00000000
0x00000000
0x049f284e
0x049f2850
0x049f2851
0x049f2854
0x049f2857
0x049f285a
0x049f285c
0x049f285d
0x00000000
0x00000000
0x049f275d
0x049f2761
0x00000000
0x049f2767
0x049f276e
0x049f2773
0x049f2773
0x049f2776
0x049f2778
0x049f277e
0x049f277e
0x049f2781
0x049f2781
0x049f2783
0x049f2784
0x00000000
0x00000000
0x04a35bd8
0x04a35bde
0x04a35be4
0x04a35be6
0x04a35be8
0x04a35be9
0x04a35bee
0x04a35bf8
0x04a35bff
0x04a35c01
0x04a35c04
0x04a35c07
0x04a35c0b
0x04a35c0d
0x04a35c0d
0x04a35c15
0x04a35c18
0x04a35c1b
0x04a35c1b
0x04a35c1e
0x00000000
0x00000000
0x049f28c3
0x049f28c8
0x049f28d2
0x049f28d4
0x049f28d8
0x049f28db
0x04a35c26
0x04a35c28
0x04a35c2d
0x04a35c2d
0x00000000
0x00000000
0x04a35c34
0x04a35c36
0x04a35c49
0x04a35c4e
0x04a35c54
0x04a35c5b
0x04a35c5d
0x04a35c60
0x049f2788
0x049f2788
0x049f278b
0x049f278e
0x049f278e
0x049f278e
0x049f2791
0x00000000
0x00000000
0x049f2756
0x049f2750
0x00000000
0x049f2794
0x049f2794
0x049f2795
0x049f2798
0x049f2798
0x00000000
0x049f2734
0x049f272c
0x049f2700
0x049f25ef
0x049f25ef
0x049f25ef
0x049f25f2
0x049f25f8
0x00000000
0x00000000
0x049f25fe
0x00000000
0x049f28e6
0x049f28ec
0x049f28ef
0x049f28f5
0x049f28f8
0x049f28f8
0x00000000
0x049f28f8
0x00000000
0x00000000
0x049f2866
0x049f2866
0x049f2876
0x049f2879
0x00000000
0x00000000
0x049f27e0
0x049f27e7
0x049f27e9
0x049f27eb
0x04a35afd
0x00000000
0x04a35afd
0x00000000
0x00000000
0x049f2633
0x049f2638
0x049f263b
0x049f263c
0x049f263e
0x049f2640
0x049f2642
0x049f2647
0x049f2649
0x049f264e
0x049f2650
0x049f2653
0x049f2659
0x049f26a2
0x049f26a7
0x049f26ac
0x049f26b2
0x04a35b11
0x04a35b15
0x04a35b17
0x00000000
0x049f26b8
0x049f26b8
0x049f26ba
0x049f27a6
0x049f27a6
0x049f27a9
0x049f27ab
0x049f27b9
0x049f27b9
0x049f27be
0x049f27c1
0x049f27c3
0x049f27c5
0x049f27c7
0x04a35c74
0x04a35c79
0x04a35c79
0x049f27c7
0x00000000
0x049f26c0
0x049f26c0
0x049f26c3
0x049f26c6
0x049f26c6
0x049f26c9
0x049f26c9
0x00000000
0x049f26c9
0x049f26ba
0x049f265b
0x049f265b
0x049f265e
0x049f2667
0x049f266d
0x049f2677
0x049f267c
0x049f267f
0x049f2681
0x04a35b49
0x04a35b4e
0x049f27cd
0x049f27d0
0x049f27d1
0x049f27d2
0x049f27d4
0x049f27dd
0x049f2687
0x049f2687
0x049f268a
0x049f268b
0x049f268e
0x049f268f
0x049f2691
0x049f2696
0x049f2698
0x049f269d
0x049f269f
0x00000000
0x049f269f
0x049f2681
0x00000000
0x00000000
0x049f2846
0x00000000
0x00000000
0x049f2605
0x049f260a
0x049f260c
0x049f2611
0x049f2616
0x049f2619
0x049f2619
0x049f261e
0x00000000
0x049f2624
0x049f2627
0x049f2627
0x00000000
0x00000000
0x04a35b1f
0x00000000
0x00000000
0x049f2894
0x049f289b
0x049f289d
0x049f28a1
0x04a35b2b
0x04a35b2e
0x04a35b2e
0x049f28a7
0x049f28a9
0x04a35b04
0x04a35b09
0x04a35b09
0x04a35b09
0x00000000
0x00000000
0x04a35b35
0x04a35b3c
0x049f28fb
0x049f28fb
0x049f26cc
0x049f26cc
0x049f26d0
0x00000000
0x049f26d2
0x049f26d2
0x00000000
0x049f26d2
0x00000000
0x00000000
0x049f25fe
0x049f292d
0x049f2930
0x049f2935
0x049f2937
0x049f293a
0x049f2942
0x049f2946
0x049f294c
0x049f294f
0x049f2954
0x049f2956
0x049f2957
0x049f295e
0x049f2966
0x049f296e
0x049f296f
0x049f2970
0x049f2972
0x049f2973
0x049f297a
0x049f297b
0x049f2980
0x049f2981
0x049f2982
0x049f2983
0x049f2984
0x049f2985
0x049f2986
0x049f2987
0x049f2988
0x049f2989
0x049f298a
0x049f298b
0x049f298c
0x049f298d
0x049f298e
0x049f298f
0x049f2990
0x049f2992
0x049f2997
0x049f29a3
0x049f29a6
0x049f29ab
0x049f29ad
0x049f29b0
0x049f29b2
0x04a35c80
0x049f29b8
0x049f29b8
0x049f29bb
0x049f29c0
0x049f29c5
0x049f29c6
0x049f29c6
0x049f29c9
0x049f29cb
0x00000000
0x00000000
0x049f29cd
0x049f29d0
0x049f29d9
0x049f29db
0x049f29dd
0x049f2a7f
0x049f2a84
0x049f2a87
0x049f2a89
0x04a35ca1
0x04a35ca3
0x00000000
0x049f2a8f
0x049f2a8f
0x00000000
0x049f2a8f
0x00000000
0x049f29e3
0x049f29e3
0x049f29e3
0x00000000
0x049f29e3
0x049f29dd
0x00000000
0x049f29db
0x049f29e6
0x049f29e9
0x049f29eb
0x049f29ed
0x049f29f3
0x049f29f5
0x049f29f8
0x049f29fa
0x049f2a97
0x049f2a9a
0x049f2a9d
0x049f2add
0x00000000
0x049f2a9f
0x049f2aa2
0x049f2aa5
0x049f2aa8
0x049f2aab
0x04a35cab
0x04a35caf
0x04a35cc5
0x04a35cda
0x04a35cdc
0x04a35cdf
0x04a35ce5
0x00000000
0x04a35ceb
0x04a35ced
0x04a35cee
0x00000000
0x04a35cee
0x04a35cb1
0x04a35cb4
0x04a35cb9
0x04a35cbb
0x00000000
0x04a35cbd
0x04a35cbd
0x00000000
0x04a35cbd
0x04a35cbb
0x049f2ab1
0x049f2ab1
0x049f2ac4
0x049f2ac6
0x049f2ac6
0x00000000
0x049f2ac6
0x049f2aab
0x00000000
0x049f2a00
0x049f2a09
0x049f2a0e
0x049f2a21
0x049f2a24
0x049f2a35
0x049f2a3a
0x049f2a3d
0x049f2a42
0x049f2a59
0x049f2a59
0x049f2a5c
0x049f2a5f
0x049f2a5f
0x049f29fa
0x049f29f3
0x049f2a64
0x049f2a64
0x049f2a6b
0x049f2a6b
0x049f2a6d
0x049f2a72
0x049f2a72
0x00000000

Strings

PATH, xrefs: 049F2642, 049F2691

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: ce4739a62b5408a933a10bcc1f69d9b159254797607a8e4ba9b24f9871deb841
Instruction ID: 00582c3ee31b018a9856a5419e8c4bcda6eff8bfbe7af74cc322dd4f1cb737fe
Opcode Fuzzy Hash: ce4739a62b5408a933a10bcc1f69d9b159254797607a8e4ba9b24f9871deb841
Instruction Fuzzy Hash: 47C1AD71E00609EBDB24DF99DC80BAEB7B5FF88714F144469E901AB290E775B941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 049FFAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E049FFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E049DEEF0(0x4ab7b60);
					_t134 =  *0x4ab7b84; // 0x77f07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4ab7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4ab7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E049D6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E049D76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E04A68938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E049CB150();
													}
													_t116 = E04A66D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E049D75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4ab8638; // 0x2dca830
																	_t122 = L049D38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E049D76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E049D76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L049FFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L049D70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E049FFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E049FFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E049FFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E049FFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E049FFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4ab7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4ab7b84 = _t75;
						_t73 = E049DEB70(_t134, 0x4ab7b60);
						if( *0x4ab7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E049DFF60( *0x4ab7b20);
							}
						}
						goto L5;
					}
				}
			}

0x049ffab0
0x049ffab2
0x049ffab3
0x049ffab4
0x049ffabc
0x049ffac0
0x049ffb14
0x049ffb17
0x049ffac2
0x049ffac8
0x049ffacd
0x049ffad3
0x049ffad3
0x049ffadd
0x049ffb18
0x049ffb1b
0x049ffb1d
0x049ffb1e
0x049ffb1f
0x049ffb20
0x049ffb21
0x049ffb22
0x049ffb23
0x049ffb24
0x049ffb25
0x049ffb26
0x049ffb27
0x049ffb28
0x049ffb29
0x049ffb2a
0x049ffb2b
0x049ffb2c
0x049ffb2d
0x049ffb2e
0x049ffb2f
0x049ffb3a
0x049ffb3b
0x049ffb3e
0x049ffb41
0x049ffb44
0x049ffb47
0x049ffb4a
0x049ffb4d
0x049ffb53
0x04a3bdcb
0x04a3bdcb
0x049ffb59
0x049ffb5b
0x049ffb5b
0x049ffb5e
0x04a3bdd5
0x04a3bdd8
0x00000000
0x04a3bdda
0x00000000
0x04a3bdda
0x049ffb64
0x049ffb64
0x049ffb64
0x049ffb67
0x049ffb6e
0x049ffb70
0x049ffb72
0x00000000
0x049ffb78
0x049ffb7a
0x049ffb7a
0x049ffb7d
0x049ffb80
0x04a3bddf
0x04a3bde1
0x00000000
0x04a3bde3
0x00000000
0x04a3bde3
0x049ffb86
0x049ffb86
0x049ffb86
0x049ffb8b
0x049ffb90
0x049ffb92
0x049ffb94
0x049ffb9a
0x049ffb9b
0x049ffba1
0x04a3bde8
0x04a3bdeb
0x04a3bded
0x04a3beb5
0x04a3beb5
0x04a3bebb
0x04a3bebd
0x04a3bec3
0x04a3bed2
0x04a3bedd
0x04a3bedd
0x04a3beed
0x00000000
0x04a3bdf3
0x04a3bdfe
0x04a3be06
0x04a3be0b
0x04a3be0d
0x04a3be0f
0x04a3be14
0x04a3be19
0x04a3be20
0x04a3be25
0x04a3be27
0x04a3be35
0x04a3be39
0x04a3be46
0x04a3be4f
0x04a3be54
0x04a3be56
0x04a3bef8
0x04a3bef8
0x00000000
0x04a3be5c
0x04a3be5c
0x04a3be60
0x00000000
0x04a3be66
0x04a3be66
0x04a3be7f
0x04a3be84
0x04a3be87
0x04a3be89
0x04a3be8b
0x04a3be99
0x04a3be9d
0x04a3bea0
0x04a3beac
0x04a3beaf
0x04a3beb1
0x04a3beb3
0x04a3beb3
0x00000000
0x04a3bea2
0x04a3bea2
0x00000000
0x04a3bea2
0x04a3be8d
0x04a3be8d
0x04a3be92
0x00000000
0x04a3be92
0x04a3be8b
0x04a3be60
0x04a3be3b
0x04a3be3b
0x04a3be3e
0x00000000
0x04a3be40
0x04a3be40
0x04a3be44
0x00000000
0x00000000
0x00000000
0x00000000
0x04a3be44
0x04a3be3e
0x04a3be29
0x04a3be29
0x00000000
0x04a3be29
0x04a3be27
0x00000000
0x049ffba7
0x049ffba7
0x049ffbab
0x04a3bf02
0x049ffbb1
0x049ffbb1
0x049ffbb8
0x049ffbbd
0x049ffbbd
0x049ffbbf
0x049ffbbf
0x049ffbc5
0x049ffbcb
0x049ffbf8
0x049ffbf8
0x049ffbfa
0x00000000
0x049ffc00
0x049ffc00
0x049ffc03
0x00000000
0x049ffc09
0x049ffc09
0x049ffc0f
0x049ffc15
0x049ffc23
0x049ffc23
0x049ffc25
0x049ffc27
0x049ffc75
0x049ffc7c
0x049ffc84
0x00000000
0x049ffc29
0x049ffc29
0x049ffc2d
0x049ffc30
0x04a3bf0f
0x00000000
0x049ffc36
0x049ffc38
0x049ffc3b
0x049ffc41
0x04a3bf17
0x04a3bf19
0x04a3bf48
0x04a3bf4b
0x00000000
0x04a3bf1b
0x04a3bf22
0x04a3bf24
0x04a3bf26
0x00000000
0x04a3bf2c
0x04a3bf37
0x04a3bf39
0x04a3bf3b
0x00000000
0x04a3bf41
0x04a3bf41
0x04a3bf41
0x04a3bf41
0x04a3bf45
0x00000000
0x04a3bf45
0x04a3bf3b
0x04a3bf26
0x00000000
0x049ffc47
0x049ffc47
0x049ffc49
0x049ffcb2
0x049ffcb4
0x049ffcb6
0x049ffcdc
0x049ffcdc
0x00000000
0x049ffcb8
0x049ffcc3
0x049ffcc5
0x049ffcc7
0x00000000
0x049ffcc9
0x049ffcc9
0x049ffccd
0x00000000
0x049ffccd
0x049ffcc7
0x00000000
0x049ffc4b
0x049ffc4b
0x049ffc4e
0x049ffc4e
0x049ffc51
0x049ffc51
0x049ffc54
0x049ffc5a
0x049ffc5c
0x049ffc5f
0x049ffc61
0x049ffc63
0x049ffc65
0x049ffc67
0x049ffc6e
0x049ffc72
0x049ffc72
0x049ffc72
0x049ffc72
0x049ffc67
0x049ffc61
0x00000000
0x049ffc5a
0x049ffc49
0x049ffc41
0x049ffc30
0x049ffc27
0x049ffc03
0x049ffbcd
0x049ffbd3
0x049ffbd9
0x049ffbdc
0x049ffbde
0x049ffc99
0x049ffc9b
0x049ffc9d
0x049ffcd5
0x049ffcd5
0x049ffc89
0x049ffc89
0x00000000
0x049ffc9f
0x049ffc9f
0x049ffca3
0x00000000
0x049ffca3
0x00000000
0x049ffbe4
0x049ffbe4
0x049ffbe4
0x049ffbe4
0x049ffbe9
0x049ffbf2
0x00000000
0x049ffbf2
0x049ffbde
0x049ffbcb
0x049ffbab
0x049ffc8b
0x049ffc8b
0x049ffc8c
0x049ffb80
0x049ffb72
0x049ffb5e
0x049ffc8d
0x049ffc91
0x049ffadf
0x049ffadf
0x049ffae1
0x049ffae4
0x049ffae7
0x049ffaec
0x049ffaf8
0x049ffb00
0x049ffb07
0x049ffb0f
0x049ffb0f
0x049ffb07
0x00000000
0x049ffaf8
0x049ffadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 04A3BE0F

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 82a3d3e01786e3ece4ce156a86308d9a4c16ad639d69d5eebf58eaac564374ff
Instruction ID: 6921b07cf439ffd8a8154c89ac629ee00341479719dcd0b5717f2016b969f452
Opcode Fuzzy Hash: 82a3d3e01786e3ece4ce156a86308d9a4c16ad639d69d5eebf58eaac564374ff
Instruction Fuzzy Hash: 46A11431B006158FEB25DF68C850B7AB3AAAF84715F14457EEA06DB695FB34F801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 049C2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E049C2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4ab5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4ab7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E04A097C0();
				}
				if( *0x4ab79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x4ab79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E049F1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E049E7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E04A5FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E04A09520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E049FE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L04A1DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4ab6901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4ab6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E04A09980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E04A095D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E049E7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E049E7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E04A47016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E04A5FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4ab5350;
							if(_t109 != 0x4ab5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E04A5FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E04A55720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x049c2d8a
0x049c2d8a
0x049c2d92
0x049c2d96
0x049c2d9e
0x049c2da0
0x049c2da3
0x049c2da5
0x049c2da8
0x049c2dab
0x049c2db2
0x04a1f9aa
0x04a1f9ab
0x04a1f9ae
0x04a1f9ae
0x049c2db8
0x049c2dc2
0x04a1f9b9
0x04a1f9be
0x04a1f9bf
0x04a1f9bf
0x049c2dcf
0x04a1f9c9
0x049c2dd5
0x049c2dd5
0x049c2dd5
0x049c2dde
0x049c2de1
0x049c2e70
0x049c2e72
0x049c2e72
0x049c2de7
0x049c2deb
0x049c2e7c
0x049c2e83
0x049c2e85
0x049c2e8b
0x049c2e8d
0x049c2e92
0x049c2e92
0x049c2e85
0x049c2df1
0x049c2df7
0x049c2df9
0x049c2df9
0x049c2dfc
0x049c2dff
0x049c2e02
0x00000000
0x049c2e05
0x049c2e0c
0x04a1f9d9
0x049c2e12
0x049c2e12
0x049c2e12
0x049c2e1a
0x04a1f9e3
0x04a1f9e9
0x04a1f9f0
0x04a1f9f6
0x04a1f9f8
0x04a1f9f8
0x04a1f9f0
0x049c2e23
0x04a1fa02
0x04a1fa03
0x04a1fa05
0x04a1fa06
0x00000000
0x049c2e29
0x049c2e29
0x049c2e2e
0x049c2e34
0x049c2e3e
0x00000000
0x00000000
0x049c2e44
0x049c2e47
0x049c2e4d
0x00000000
0x00000000
0x049c2e4f
0x049c2e54
0x00000000
0x00000000
0x049c2e5a
0x049c2e5f
0x049c2e9a
0x049c2ea4
0x049c2ea5
0x049c2ea8
0x049c2eaf
0x049c2eb2
0x049c2eb5
0x04a1fae9
0x04a1faeb
0x04a1faed
0x04a1faef
0x04a1faf7
0x04a1faf8
0x04a1fafd
0x04a1faff
0x04a1fb04
0x04a1fb04
0x04a1faff
0x049c2ec0
0x049c2ec4
0x049c2ec6
0x049c2ec8
0x04a1fb14
0x04a1fb18
0x04a1fb1e
0x04a1fb21
0x04a1fb21
0x049c2ece
0x049c2ece
0x049c2ece
0x049c2ed7
0x049c2e61
0x049c2e63
0x04a1fa6b
0x04a1fa71
0x04a1fa76
0x04a1fa78
0x04a1fa8a
0x04a1fa7a
0x04a1fa83
0x04a1fa83
0x04a1fa8f
0x04a1fa91
0x04a1fa97
0x04a1fa9d
0x04a1faa4
0x04a1faaa
0x04a1faaf
0x04a1fab1
0x04a1fac3
0x04a1fab3
0x04a1fabc
0x04a1fabc
0x04a1fac8
0x04a1facb
0x04a1fadf
0x04a1fadf
0x04a1facb
0x04a1faa4
0x04a1fa91
0x049c2e6f
0x049c2e6f
0x049c2e5f
0x04a1fa13
0x04a1fa15
0x04a1fa17
0x04a1fa1f
0x04a1fa21
0x04a1fa22
0x04a1fa25
0x04a1fa28
0x04a1fa2f
0x04a1fa2f
0x04a1fa2a
0x04a1fa2a
0x04a1fa2a
0x04a1fa31
0x04a1fa34
0x04a1fa36
0x04a1fa3c
0x04a1fa3e
0x04a1fa41
0x04a1fa43
0x04a1fa45
0x04a1fa45
0x04a1fa41
0x04a1fa3c
0x04a1fa4a
0x04a1fa4f
0x04a1fa51
0x04a1fa53
0x04a1fa56
0x04a1fa5b
0x04a1fa5e
0x00000000
0x04a1fa5e
0x049c2e23

Strings

RTL: Re-Waiting, xrefs: 04A1FA4A

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 6c10395bf401b3ab4fffa958176bf268eef7607acf65225d91a8a17d290e52c5
Instruction ID: 5eeb8f874adb6fb3cbd5e5d9246081963b5b831515ae67e98525cac73b38513c
Opcode Fuzzy Hash: 6c10395bf401b3ab4fffa958176bf268eef7607acf65225d91a8a17d290e52c5
Instruction Fuzzy Hash: 91612571F00684EFEB31DF68C844B7E77A6EB44718F1406BAE811A72E1D738B9418792

Uniqueness

Uniqueness Score: -1.00%

Function 04A90EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04A90EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E04A8FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E04A91074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E04A09730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E04A8A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E04A8A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4ab8b04 >> 0x14) + (_v44 -  *0x4ab8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E049E7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E04A8138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E049E7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E04A7FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4ab8724 & 0x00000008) != 0) {
						E04A852F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E04A915B5(0x4ab8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x04a90eb7
0x04a90eb9
0x04a90ec0
0x04a90ec2
0x04a90ecd
0x04a9105b
0x04a9105b
0x04a91061
0x04a91066
0x04a91066
0x04a9106b
0x04a91073
0x04a91073
0x04a90ed3
0x04a90ed6
0x04a90edc
0x04a90ee0
0x04a90ee7
0x04a90ef0
0x04a90ef5
0x04a90efa
0x04a90efc
0x04a90efd
0x04a90f03
0x04a90f04
0x04a90f06
0x04a90f07
0x04a90f09
0x04a90f0e
0x04a90f14
0x04a90f23
0x04a90f2d
0x04a90f34
0x04a90f34
0x04a90f14
0x04a90f52
0x00000000
0x00000000
0x04a90f58
0x04a90f73
0x04a90f74
0x04a90f79
0x04a90f7d
0x04a90f80
0x04a90f86
0x04a90fab
0x04a90fb5
0x04a90fc6
0x04a90fd1
0x04a90fe3
0x04a90fd3
0x04a90fdc
0x04a90fdc
0x04a90feb
0x04a91009
0x04a91009
0x04a91015
0x04a91027
0x04a91017
0x04a91020
0x04a91020
0x04a9102f
0x04a9103c
0x04a9103c
0x04a91048
0x04a91050
0x04a91050
0x04a91055
0x00000000
0x04a91055
0x04a90f88
0x04a90f9e
0x04a90fa2
0x04a90fa9
0x00000000
0x00000000
0x00000000
0x04a90fa9
0x00000000

Strings

`, xrefs: 04A90F16

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: a035e9cefc36335c28b742cf3de1ab23c9a70925516b9633fb7347cfc9ab371e
Instruction ID: 190547a8dd4862f6b7bb985f293080ff16cf7f6295f3d347b9ab131e9af93216
Opcode Fuzzy Hash: a035e9cefc36335c28b742cf3de1ab23c9a70925516b9633fb7347cfc9ab371e
Instruction Fuzzy Hash: 3251D0712083429FEB25DF29D980B1BB7E9EBC4348F04492DF98697291D635FD05CB62

Uniqueness

Uniqueness Score: -1.00%

Function 049FF0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E049FF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E049E4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E04A09830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E04A09990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E04A095D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0xdc2bc81a
							_t109 = L049E4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2002dc2b
								E04A0F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2002dc2b
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E04A095D0();
										L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x049ff0d3
0x049ff0d9
0x049ff0e0
0x049ff0e7
0x049ff0f2
0x049ff0f4
0x049ff0f8
0x049ff100
0x049ff108
0x049ff10d
0x049ff115
0x049ff116
0x049ff11f
0x049ff123
0x049ff124
0x049ff12c
0x049ff130
0x049ff134
0x049ff13d
0x049ff144
0x049ff14b
0x049ff152
0x04a3bab0
0x04a3bab0
0x049ff158
0x049ff158
0x049ff15a
0x049ff160
0x049ff165
0x049ff166
0x049ff16f
0x049ff173
0x04a3baa7
0x04a3baa7
0x04a3baab
0x00000000
0x049ff179
0x049ff179
0x049ff18d
0x049ff191
0x04a3baa2
0x00000000
0x049ff197
0x049ff19b
0x049ff1a2
0x049ff1a9
0x049ff1af
0x049ff1b2
0x049ff1b6
0x049ff1b9
0x049ff1c0
0x049ff1c4
0x049ff1d8
0x049ff1df
0x049ff1e3
0x049ff1e6
0x049ff1eb
0x049ff1ee
0x049ff1f4
0x049ff20f
0x04a3bab7
0x04a3babb
0x04a3bacc
0x04a3bad1
0x049ff215
0x049ff218
0x049ff226
0x049ff22b
0x00000000
0x049ff22b
0x049ff1f6
0x049ff1f6
0x049ff1f9
0x049ff1fb
0x049ff1fb
0x049ff1f4
0x049ff191
0x049ff173
0x049ff152
0x049ff203

Strings

@, xrefs: 049FF124

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 01ce59c1ffa51b657505ba89283ac23fcf9df6669bb36f61b91cdb7d00320146
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: B1517B716047109FD321DF59C840A6BBBF9FF88714F00892EFA9597690E7B4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A43540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E04A43540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x4abd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E04A00BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E04A43706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E04A0FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E04A43540;
						E04A0FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E04A1DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E04A50C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E04A097C0();
					}
					return E04A0B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E04A43971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E04A43884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E04A0FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E04A09650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E04A43787(_a4,  &_v352, _t80);
						}
					}
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E04A095D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x04a43552
0x04a4355a
0x04a4355d
0x04a43566
0x04a43567
0x04a4357e
0x04a4358f
0x04a435a1
0x04a435a5
0x04a4366b
0x04a4366b
0x04a4366d
0x04a43672
0x04a43679
0x04a43685
0x04a4368d
0x04a4369d
0x04a436a7
0x04a436b8
0x04a436c6
0x04a436c7
0x04a436dc
0x04a436e1
0x04a436e7
0x04a436e9
0x04a436e9
0x04a43703
0x04a43703
0x04a435b5
0x04a435c0
0x04a435c4
0x00000000
0x00000000
0x04a435ca
0x04a435d7
0x04a435e2
0x04a435e6
0x04a435e8
0x04a435f5
0x04a435fa
0x04a43603
0x04a43604
0x04a43609
0x04a4360a
0x04a43612
0x04a43613
0x04a4361e
0x04a43622
0x04a43628
0x04a4362f
0x04a4362f
0x04a43636
0x04a43638
0x04a4363b
0x04a43642
0x04a43642
0x04a43636
0x04a43657
0x04a43657
0x04a4365c
0x04a43662
0x04a43669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 04A4358F

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryHash
API String ID: 2994545307-2202222882
Opcode ID: 8437f6ba32561f9cc4ee3b568d71275d5175a9baf6de7032a5213ec1f4ef4e5b
Instruction ID: 3441475c23ad4e3d568f17d5ae432a6670f2ffea4c87079adf1c35b18550747c
Opcode Fuzzy Hash: 8437f6ba32561f9cc4ee3b568d71275d5175a9baf6de7032a5213ec1f4ef4e5b
Instruction Fuzzy Hash: 404145F1D0152D9EEF21DA50DD80FEFB77CAB84718F0045A5AA08A7240DB70AE888F94

Uniqueness

Uniqueness Score: -1.00%

Function 04A905AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E04A905AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E04A907DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E04A09730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E04A8A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E04A8A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E04A91293(_t79, _v40, E04A907DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E049E7D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E04A8138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x04a905c5
0x04a905ca
0x04a905d3
0x04a906db
0x04a906db
0x04a906dd
0x04a906e3
0x04a906e3
0x04a905dd
0x04a905e7
0x04a905f6
0x04a90600
0x04a90607
0x04a90610
0x04a90615
0x04a9061a
0x04a9061c
0x04a9061e
0x04a90624
0x04a90625
0x04a90627
0x04a90628
0x04a90631
0x04a90640
0x04a9064d
0x04a90654
0x04a90654
0x04a90631
0x04a9066d
0x04a90674
0x00000000
0x00000000
0x04a90692
0x04a9069e
0x04a906b0
0x04a906a0
0x04a906a9
0x04a906a9
0x04a906b8
0x04a906d6
0x04a906d6
0x00000000

Strings

`, xrefs: 04A90633

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: f8d8afa61d43ed099f0625eec696176c4e7e42853cf1ade4c059b38799731c76
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 8031B0726083456BEB20DF25CD45F9677D9EBC4798F044229BA54EB280E7B0FD04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A43884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E04A43884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E04A09650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L049E4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E04A09650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x04a43893
0x04a43896
0x04a43899
0x04a4389f
0x04a438a0
0x04a438a4
0x04a438a9
0x04a438ac
0x04a438ad
0x04a438ae
0x04a438af
0x04a438b1
0x04a438b4
0x04a438bb
0x04a438bc
0x04a438bd
0x04a438c4
0x04a438c8
0x04a438ca
0x04a438ca
0x04a438d5
0x04a4393e
0x04a43940
0x04a43942
0x04a43952
0x04a43954
0x04a43961
0x04a43961
0x04a43967
0x04a4396e
0x04a4396e
0x04a43947
0x04a4394c
0x00000000
0x04a4394c
0x04a438ea
0x04a438ee
0x04a438f8
0x04a438f9
0x04a438ff
0x04a43900
0x04a43902
0x04a43903
0x04a4390b
0x04a4390f
0x04a43950
0x00000000
0x04a43950
0x04a43915
0x04a4391d
0x04a4391d
0x04a43922
0x04a43926
0x00000000
0x04a43928
0x04a4392b
0x04a4392b
0x04a43935
0x04a43937
0x04a43937
0x00000000
0x04a43935
0x04a43926
0x04a438f0
0x00000000

Strings

BinaryName, xrefs: 04A438B4

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryName
API String ID: 2994545307-215506332
Opcode ID: 7dbab0d2caa6d092fc2a1d3a57dc7fd3f3db7f08b8919122527a8df4a13aca42
Instruction ID: dc5b2ab5bc5feca374b13598875f363577555349af054d0d0c88d558223127bf
Opcode Fuzzy Hash: 7dbab0d2caa6d092fc2a1d3a57dc7fd3f3db7f08b8919122527a8df4a13aca42
Instruction Fuzzy Hash: E331F472E01509BFEF25DB99C955D7FB774EBC0B20F014169AD14A7682D630BE00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 049FD294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E049FD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x4abd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E049E4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E04A0B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E04A098D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E04A095D0();
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x049fd29c
0x049fd2a6
0x049fd2b1
0x049fd2b5
0x049fd2b6
0x049fd2bc
0x049fd2bd
0x049fd2be
0x049fd2bf
0x049fd2c2
0x049fd2c4
0x049fd2cc
0x049fd384
0x049fd34b
0x049fd34f
0x049fd350
0x049fd351
0x049fd35c
0x049fd35c
0x049fd2d6
0x049fd2da
0x049fd2e1
0x049fd361
0x049fd369
0x049fd36d
0x049fd2e3
0x049fd2e3
0x049fd2e3
0x049fd2e5
0x049fd2ed
0x049fd2f5
0x049fd2fa
0x049fd302
0x049fd303
0x049fd30b
0x049fd30f
0x049fd313
0x049fd318
0x049fd31c
0x049fd320
0x049fd379
0x049fd37d
0x00000000
0x00000000
0x04a3affe
0x04a3b001
0x04a3b011
0x00000000
0x049fd322
0x049fd322
0x049fd330
0x049fd337
0x049fd35d
0x049fd339
0x049fd33f
0x049fd38c
0x049fd38c
0x049fd33f
0x049fd349
0x00000000
0x049fd349

Strings

@, xrefs: 049FD303

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: caebdcce3450981d77b4f828a6eeba2eea1fcb329f8309750ba846f5a2115694
Instruction ID: d523eee90dda8d77b91afac5a32930d232019b7d76966bf06449c455b49d455c
Opcode Fuzzy Hash: caebdcce3450981d77b4f828a6eeba2eea1fcb329f8309750ba846f5a2115694
Instruction Fuzzy Hash: A93195B25083059FD711DF28D98096BBBE8FBC5758F000A3EF69583250E679ED04DB92

Uniqueness

Uniqueness Score: -1.00%

Function 049D1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E049D1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E04A0BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E04A0A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E04A0A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L049E4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x049d1b8f
0x049d1b9a
0x049d1b9c
0x049d1b9e
0x049d1ba3
0x04a27010
0x04a27010
0x00000000
0x049d1ba9
0x049d1ba9
0x049d1bae
0x00000000
0x049d1bc5
0x049d1bca
0x049d1bcf
0x049d1bd0
0x049d1bd1
0x049d1bd2
0x049d1bd6
0x049d1bdc
0x049d1be0
0x04a26ffc
0x04a27000
0x00000000
0x04a27006
0x04a27009
0x04a27009
0x049d1be6
0x049d1bec
0x049d1c0b
0x049d1c0b
0x049d1c0c
0x049d1c11
0x049d1c12
0x049d1c15
0x049d1c1b
0x049d1c1f
0x049d1c31
0x049d1c33
0x04a27026
0x04a27026
0x049d1c21
0x049d1c24
0x049d1c24
0x049d1bee
0x049d1bee
0x049d1bf2
0x049d1c3a
0x049d1bf4
0x049d1bf4
0x049d1c05
0x049d1c05
0x049d1c09
0x049d1c3e
0x00000000
0x00000000
0x00000000
0x049d1c09
0x049d1bec
0x049d1be0
0x049d1bae
0x049d1c2e

Strings

WindowsExcludedProcs, xrefs: 049D1BC5

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: f5db86209aa672522d944675630247a3adeb6632b8f8731981999cb4e3f899be
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 23219877601228ABDB219FA9CA41F6B776DAF85754F058475F9049B200D634FD04A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 049EF716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049EF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x049ef71d
0x049ef722
0x049ef726
0x04a34770
0x049ef765
0x049ef769
0x049ef769
0x049ef732
0x04a3477a
0x00000000
0x04a3477a
0x049ef738
0x049ef73a
0x049ef73c
0x049ef73f
0x049ef746
0x049ef778
0x049ef7a9
0x049ef7a9
0x049ef754
0x049ef75a
0x049ef75d
0x049ef75f
0x049ef761
0x049ef76f
0x049ef771
0x049ef771
0x049ef76f
0x049ef763
0x00000000
0x049ef763
0x049ef77d
0x049ef7a3
0x049ef7a5
0x00000000
0x049ef7a5
0x049ef77f
0x049ef782
0x049ef784
0x049ef786
0x00000000
0x00000000
0x00000000
0x049ef788
0x049ef748
0x049ef74d
0x049ef78d
0x049ef793
0x049ef7b7
0x049ef7bc
0x00000000
0x049ef7bc
0x049ef798
0x00000000
0x00000000
0x049ef79d
0x049ef7b0
0x00000000
0x049ef7b0
0x049ef79f
0x00000000
0x049ef74f
0x049ef74f
0x00000000
0x049ef74f

Strings

Actx , xrefs: 049EF73F

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 2527fe3191791214a1df722b0707f264e8dc7d95b760207845b7fa7551eca6b7
Instruction ID: e84cea565a0dd3bbc87dd95896ae81e6f9ae3af1812c939837c94997fa3ce2b1
Opcode Fuzzy Hash: 2527fe3191791214a1df722b0707f264e8dc7d95b760207845b7fa7551eca6b7
Instruction Fuzzy Hash: 5F119335304A02BBE7264E1F8490736729AEBC5724F25493BE865CB399F672F8408380

Uniqueness

Uniqueness Score: -1.00%

Function 04A78DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E04A78DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x4aa0d50);
				E04A1D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E04A55720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L04A1DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L04A1DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E04A1D130(_t34, _t39, _t40);
			}

0x04a78df1
0x04a78df1
0x04a78df1
0x04a78df1
0x04a78df1
0x04a78df1
0x04a78df3
0x04a78df8
0x04a78dfd
0x04a78e00
0x04a78e0e
0x04a78e2a
0x04a78e36
0x04a78e38
0x04a78e3c
0x04a78e46
0x04a78e46
0x04a78e36
0x04a78e50
0x04a78e56
0x04a78e59
0x04a78e5c
0x04a78e60
0x04a78e67
0x04a78e6d
0x04a78e73
0x04a78e74
0x04a78eb1
0x04a78ebd

Strings

Critical error detected %lx, xrefs: 04A78E21

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: f7899b04f42736c5e12d324d0f83910ce28acd782c3d9a5541e35e4cfb1fe5c5
Instruction ID: f57868eba65e65b74480d5265c455255947e1d846b173dc077ded3e6a39ab3a5
Opcode Fuzzy Hash: f7899b04f42736c5e12d324d0f83910ce28acd782c3d9a5541e35e4cfb1fe5c5
Instruction Fuzzy Hash: C7116DB1D15348EBEF25DFA48A097DDBBB0BB04715F24425DE469AB291D3386601CF14

Uniqueness

Uniqueness Score: -1.00%

Function 04A5FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 04A5FF60

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: d502af9a918fcd04bc6ac5dc5e2b618a31a5db8da799403428e5af81d2e67616
Instruction ID: 08589b2542228cc942728afaa80908194f70f45d307ca51f51cf8da250d33c01
Opcode Fuzzy Hash: d502af9a918fcd04bc6ac5dc5e2b618a31a5db8da799403428e5af81d2e67616
Instruction Fuzzy Hash: 7011C071950244EFEB12DF50CA48F98BBB2FF49718F148454F9096BAB1C739BA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A95BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E04A95BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x4aa1178);
				E04A1D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E04A94C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E04A0D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E04A95542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x4ab60e8;
								if( *0x4ab60e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x4ab60e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E04A09710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E04A06DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E04A0F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E04A0F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E04A0F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E04A0FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E04A0FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E04A0F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E04A0F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E04A94CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E04A1D130(_t427, _t494, _t511);
				}
			}

0x04a95ba5
0x04a95baa
0x04a95baf
0x04a95bb4
0x04a95bb6
0x04a95bbc
0x04a95bbe
0x04a95bc4
0x04a95bcd
0x04a95bd3
0x04a95bd6
0x04a95bdc
0x04a95be0
0x04a95be3
0x04a95beb
0x04a95bf2
0x04a95bf8
0x04a95bfe
0x04a95c04
0x04a95c0e
0x04a95c18
0x04a95c1f
0x04a95c25
0x04a95c2a
0x04a95c2c
0x04a95c32
0x04a95c3a
0x04a95c3f
0x04a95c42
0x04a95c48
0x04a95c5b
0x04a95c5b
0x04a95c2c
0x04a95cb7
0x04a95cb9
0x04a95cbf
0x04a95cc2
0x04a95cca
0x04a95ccb
0x04a95ccb
0x04a95cd1
0x04a95cd7
0x04a95cda
0x04a95ce1
0x04a95ce4
0x04a95ce7
0x04a95ced
0x04a95cf3
0x04a95cf9
0x04a95cff
0x04a95d08
0x04a95d0a
0x04a95d0e
0x04a95d10
0x00000000
0x00000000
0x04a95d16
0x04a95d1a
0x00000000
0x00000000
0x04a95d20
0x04a95d22
0x04a95d25
0x04a95d2f
0x04a95d2f
0x04a95d33
0x04a95d3d
0x04a95d49
0x04a95d4b
0x00000000
0x00000000
0x04a95d5a
0x04a95d5d
0x04a95d60
0x00000000
0x00000000
0x04a95d66
0x04a95d69
0x00000000
0x00000000
0x04a95d6f
0x04a95d6f
0x04a95d73
0x04a95d79
0x04a95d7f
0x04a95d86
0x04a95d95
0x04a95d98
0x04a95dba
0x04a95dcb
0x04a95dce
0x04a95dd3
0x04a95dd6
0x04a95dd8
0x04a95de6
0x04a95dec
0x04a95dee
0x04a95df1
0x04a95df3
0x04a9635a
0x04a9635a
0x00000000
0x04a9635a
0x04a95dfe
0x04a95e02
0x04a95e05
0x04a95e07
0x04a95e10
0x04a95e13
0x04a95e1b
0x04a95e1c
0x04a95e21
0x04a95e22
0x04a95e23
0x04a95e25
0x04a95e2a
0x04a95e2c
0x04a95e2e
0x04a95e36
0x04a95e39
0x04a95e42
0x04a95e47
0x04a95e4d
0x04a95e54
0x04a95e54
0x04a95e54
0x04a95e2e
0x04a95e5c
0x04a95e5f
0x04a95e62
0x04a95e64
0x04a95e6b
0x04a95e70
0x04a95e7a
0x04a95e7a
0x04a95e7a
0x04a95e6b
0x04a95e7e
0x04a95e7f
0x04a95e7f
0x04a95e81
0x04a95e87
0x04a95e8b
0x04a95e8c
0x04a95e8c
0x04a95e8c
0x04a95e9a
0x04a95e9c
0x04a95ea2
0x04a95ea6
0x04a95f50
0x04a95f50
0x04a95f57
0x04a95f66
0x04a95f66
0x04a95f66
0x04a95f68
0x04a95f6a
0x04a963d0
0x00000000
0x04a95f70
0x04a95f70
0x04a95f91
0x04a95f9c
0x04a95f9e
0x04a95fa4
0x04a95fa6
0x04a9638c
0x04a96392
0x04a963a1
0x04a963a7
0x04a963af
0x04a963af
0x04a963bd
0x04a963d8
0x00000000
0x04a963d8
0x04a95fac
0x04a95fb2
0x04a95fb4
0x04a95fbd
0x04a95fc6
0x04a95fce
0x04a95fd4
0x04a95fdc
0x04a95fec
0x04a95fed
0x04a95fee
0x04a95fef
0x04a95ff9
0x04a95ffa
0x04a95ffb
0x04a95ffc
0x04a96000
0x04a96004
0x04a96012
0x04a96012
0x04a96018
0x04a96019
0x04a9601a
0x04a9601b
0x04a9601c
0x04a96020
0x04a96059
0x04a9605c
0x04a96061
0x04a96061
0x04a96022
0x04a96022
0x04a96022
0x04a96025
0x04a9602a
0x04a9602b
0x04a96031
0x04a96037
0x04a96038
0x04a9603e
0x04a96048
0x04a96049
0x04a9604a
0x04a9604b
0x04a9604c
0x04a9604d
0x04a96053
0x04a96054
0x04a96054
0x04a96062
0x04a96065
0x04a96067
0x04a9606a
0x04a96070
0x04a96075
0x04a96076
0x04a96081
0x04a96087
0x04a96095
0x04a96099
0x04a9609e
0x04a960a4
0x04a960ae
0x04a960b0
0x04a960b3
0x04a960b6
0x04a960b8
0x04a960ba
0x04a960ba
0x04a960ba
0x04a960ba
0x04a960be
0x04a960c0
0x04a960c5
0x04a960c5
0x04a960c5
0x04a960c6
0x04a960cd
0x04a96114
0x04a960cf
0x04a960cf
0x04a960d4
0x04a960d5
0x04a960da
0x04a960db
0x04a960e1
0x04a960e2
0x04a960e8
0x04a960f8
0x04a960fd
0x04a960fe
0x04a96102
0x04a96104
0x04a96107
0x04a96109
0x04a9610b
0x04a9610b
0x04a9610b
0x04a9610b
0x04a9610f
0x04a9610f
0x04a96117
0x04a9611a
0x04a9611f
0x04a96125
0x04a96134
0x04a96139
0x04a9613f
0x04a96146
0x04a96148
0x04a9614b
0x04a9614d
0x04a9614f
0x04a9614f
0x04a9614f
0x04a9614f
0x04a96153
0x04a96159
0x04a96159
0x04a9615c
0x04a96163
0x04a96169
0x04a9616c
0x04a96172
0x04a96181
0x04a96186
0x04a96187
0x04a9618b
0x04a96191
0x04a96195
0x04a961a3
0x04a961bb
0x04a961c0
0x04a961c3
0x04a961cc
0x04a961d0
0x04a961dc
0x04a961de
0x04a961e1
0x04a961e4
0x04a961e6
0x04a961e8
0x04a961e8
0x04a961e8
0x04a961e8
0x04a961e6
0x04a961ec
0x04a961f3
0x04a96203
0x04a96209
0x04a9620a
0x04a96216
0x04a9621d
0x04a96227
0x04a96241
0x04a96246
0x04a9624c
0x04a96257
0x04a96259
0x04a9625c
0x04a9625e
0x04a96260
0x04a96260
0x04a96260
0x04a96260
0x04a9625e
0x04a96264
0x04a96267
0x04a96269
0x04a96315
0x04a96315
0x04a9631b
0x04a9631e
0x04a96324
0x04a96327
0x04a9632f
0x04a96330
0x04a96333
0x04a9633a
0x04a9633c
0x04a96335
0x04a96335
0x04a96335
0x04a9633f
0x04a96342
0x04a9634c
0x04a96352
0x04a96355
0x04a96355
0x04a96359
0x00000000
0x04a9626f
0x04a96275
0x04a96275
0x04a96278
0x04a9627e
0x04a9627e
0x04a96281
0x04a96287
0x04a9628d
0x04a96298
0x04a9629c
0x04a962a2
0x04a9629e
0x04a9629e
0x04a9629e
0x04a962a7
0x04a962a7
0x04a962aa
0x04a962b0
0x04a962f0
0x04a962f0
0x04a962f2
0x04a962f8
0x04a962fd
0x04a962b2
0x04a962b2
0x04a962b2
0x04a962b5
0x04a962dd
0x04a962e2
0x04a962e5
0x04a962b7
0x04a962b8
0x04a962bb
0x04a962bd
0x04a962c0
0x04a962c4
0x04a962cd
0x04a962cd
0x04a962c0
0x04a962bb
0x04a962b5
0x04a96302
0x04a96303
0x04a96305
0x04a96305
0x04a96305
0x04a9630c
0x04a9630c
0x00000000
0x04a9627e
0x04a96269
0x04a95eac
0x04a95ebb
0x04a95ebe
0x04a95ecb
0x04a95ecb
0x04a95ece
0x04a95ece
0x04a95ed4
0x04a95ed7
0x04a95ed9
0x04a95edb
0x04a95edb
0x04a95ee1
0x04a95ee1
0x04a95ee3
0x04a95f20
0x04a95f20
0x04a95ee5
0x04a95ee5
0x04a95ee5
0x04a95ee8
0x04a95f11
0x04a95f18
0x04a95eea
0x04a95eea
0x04a95eed
0x04a95ef2
0x04a95ef8
0x04a95efb
0x04a95f0a
0x04a95f0a
0x04a95eed
0x04a95ee8
0x04a95f22
0x04a95f28
0x00000000
0x00000000
0x04a95f30
0x04a95f31
0x04a95f37
0x04a95f3a
0x04a95f3d
0x04a95f44
0x00000000
0x00000000
0x00000000
0x04a95f46
0x04a95f48
0x04a95f4d
0x00000000
0x04a95f4d
0x04a95dda
0x04a95ddf
0x00000000
0x04a95ddf
0x04a95dd8
0x04a95da7
0x04a95da9
0x04a95dac
0x04a95dae
0x00000000
0x04a95db4
0x04a95db4
0x00000000
0x04a95db4
0x04a95dae
0x04a95d88
0x04a95d8d
0x04a96363
0x04a96369
0x04a9636a
0x04a96370
0x04a96372
0x04a9637a
0x04a9637b
0x04a9637d
0x00000000
0x00000000
0x04a9637f
0x04a96385
0x00000000
0x04a96385
0x04a95d38
0x04a95d3b
0x00000000
0x00000000
0x00000000
0x04a95d3b
0x04a95d27
0x04a95d29
0x00000000
0x00000000
0x00000000
0x04a96360
0x00000000
0x04a96360
0x04a95c10
0x04a95c10
0x04a963da
0x04a963e5
0x04a963e5

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b642c79940f8e4f9a9323d9379fb2e76e6fa5a48205ca89f911d17fcd7a457
Instruction ID: 5a2196d8bd1d42524355b213d24b5b0f7fd1ec150d989fcef461ff1ab5898d54
Opcode Fuzzy Hash: b3b642c79940f8e4f9a9323d9379fb2e76e6fa5a48205ca89f911d17fcd7a457
Instruction Fuzzy Hash: B4423975E002299FDB25CF68C981BAAB7F1FF45304F1481AAD84DAB242E774AD85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 049E4120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E049E4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x4abd360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E049FF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E049E6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L049E4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E049E6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M049E45F8))) {
												case 0:
													_v568 = 0x49a1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x49a11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L049E4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E04A0F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E04A0F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E049C52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E049DEB70(1, 0x4ab79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E049DAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E04A095D0();
																			L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E04A0B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E04A03D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E04A0B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x049e4128
0x049e4135
0x049e413c
0x049e4141
0x049e4145
0x049e4147
0x049e414e
0x049e4151
0x049e4159
0x049e415c
0x049e4160
0x049e4164
0x049e4168
0x049e416c
0x049e417f
0x049e4181
0x049e446a
0x049e446a
0x049e418c
0x049e4195
0x049e4199
0x049e4432
0x049e4439
0x049e443d
0x049e4442
0x049e4447
0x00000000
0x049e419f
0x049e41a3
0x049e41b1
0x049e41b9
0x049e41bd
0x049e45db
0x049e45db
0x00000000
0x049e41c3
0x049e41c3
0x049e41ce
0x049e41d4
0x04a2e138
0x04a2e13e
0x04a2e169
0x04a2e16d
0x04a2e19e
0x04a2e16f
0x04a2e16f
0x04a2e175
0x04a2e179
0x04a2e18f
0x04a2e193
0x00000000
0x04a2e199
0x00000000
0x04a2e199
0x04a2e193
0x00000000
0x00000000
0x00000000
0x049e41da
0x049e41da
0x049e41df
0x049e41e4
0x049e41ec
0x049e4203
0x049e4207
0x04a2e1fd
0x049e4222
0x049e4226
0x04a2e1f3
0x04a2e1f3
0x049e422c
0x049e422c
0x049e4233
0x04a2e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x049e4239
0x049e4239
0x049e4239
0x049e4239
0x049e4233
0x049e4226
0x049e41ee
0x049e41ee
0x049e41f4
0x049e4575
0x04a2e1b1
0x04a2e1b1
0x00000000
0x049e457b
0x049e457b
0x049e4582
0x04a2e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x049e4588
0x049e4588
0x049e458c
0x04a2e1c4
0x04a2e1c4
0x00000000
0x049e4592
0x049e4592
0x049e4599
0x04a2e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x049e459f
0x049e459f
0x049e45a3
0x04a2e1d7
0x04a2e1e4
0x00000000
0x049e45a9
0x049e45a9
0x049e45b0
0x04a2e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x049e45b6
0x049e45b6
0x049e45b6
0x00000000
0x049e45b6
0x049e45b0
0x049e45a3
0x049e4599
0x049e458c
0x049e4582
0x00000000
0x00000000
0x00000000
0x00000000
0x049e41f4
0x049e423e
0x049e4241
0x049e45c0
0x049e45c4
0x00000000
0x049e45ca
0x049e45ca
0x00000000
0x04a2e207
0x04a2e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x049e45d1
0x00000000
0x00000000
0x049e45ca
0x00000000
0x049e4247
0x049e4247
0x049e4247
0x049e4249
0x049e4249
0x049e4249
0x049e4251
0x049e4251
0x049e4257
0x049e425f
0x049e426e
0x049e4270
0x049e427a
0x04a2e219
0x04a2e219
0x049e4280
0x049e4282
0x049e4456
0x049e45ea
0x00000000
0x049e45f0
0x04a2e223
0x00000000
0x04a2e223
0x049e445c
0x049e445c
0x00000000
0x049e445c
0x00000000
0x049e4288
0x049e428c
0x04a2e298
0x049e4292
0x049e4292
0x049e429e
0x049e42a3
0x049e42a7
0x049e42ac
0x04a2e22d
0x049e42b2
0x049e42b2
0x049e42b9
0x049e42bc
0x049e42c2
0x049e42ca
0x049e42cd
0x049e42cd
0x049e42d4
0x049e433f
0x049e433f
0x049e42d6
0x049e42d6
0x049e42d9
0x049e42dd
0x049e42eb
0x04a2e23a
0x049e42f1
0x049e4305
0x049e430d
0x049e4315
0x049e4318
0x049e431f
0x049e4322
0x049e432e
0x049e433b
0x049e433b
0x00000000
0x049e432e
0x049e42eb
0x049e434c
0x049e434e
0x049e4352
0x049e4359
0x049e435e
0x049e4361
0x049e436e
0x049e438a
0x049e438e
0x049e4396
0x049e439e
0x049e43a1
0x049e43ad
0x049e43bb
0x049e43bb
0x049e43ad
0x049e436e
0x049e43bf
0x049e43c5
0x049e4463
0x049e4463
0x049e43ce
0x049e43d5
0x049e43d9
0x049e43df
0x049e4475
0x049e4479
0x049e4491
0x049e4491
0x049e4479
0x049e43e5
0x049e43eb
0x049e43f4
0x049e43f6
0x049e43f9
0x049e43fc
0x049e43ff
0x049e44e8
0x049e44ed
0x049e44f3
0x04a2e247
0x00000000
0x049e44f9
0x049e4504
0x049e4508
0x049e450f
0x04a2e269
0x00000000
0x049e4515
0x049e4519
0x049e4531
0x049e4534
0x049e4537
0x049e453e
0x049e4541
0x049e454a
0x04a2e255
0x04a2e255
0x04a2e25b
0x04a2e25e
0x04a2e261
0x04a2e261
0x049e4555
0x049e4559
0x049e455d
0x04a2e26d
0x04a2e270
0x04a2e274
0x04a2e27a
0x04a2e27d
0x04a2e28e
0x04a2e28e
0x049e4563
0x049e4563
0x049e4569
0x049e4569
0x00000000
0x049e455d
0x049e450f
0x00000000
0x049e44f3
0x049e43ff
0x049e4405
0x049e4405
0x049e4405
0x049e42ac
0x049e428c
0x049e4282
0x049e4407
0x049e440d
0x04a2e2af
0x04a2e2af
0x049e4413
0x049e4413
0x00000000
0x049e41d4
0x00000000
0x049e41c3
0x049e41bd
0x049e4415
0x049e4415
0x049e4416
0x049e4417
0x049e4429
0x049e416e
0x049e416e
0x049e4175
0x049e4498
0x049e449f
0x04a2e12d
0x00000000
0x04a2e133
0x00000000
0x04a2e133
0x049e44a5
0x049e44a5
0x049e44aa
0x00000000
0x049e44bb
0x049e44ca
0x049e44d6
0x049e44d7
0x049e44d8
0x049e44e3
0x049e44e3
0x049e44aa
0x049e417b
0x049e417b
0x049e417b
0x00000000
0x049e417b
0x049e4175
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2961f654cbb79bc8652370031fdfc8690133a2b2a1417a19a4e1c3bf43b725c
Instruction ID: a9869271ea419e77d9048a23a3185f75ca0665faa0f14bdf9e524f503e127c53
Opcode Fuzzy Hash: f2961f654cbb79bc8652370031fdfc8690133a2b2a1417a19a4e1c3bf43b725c
Instruction Fuzzy Hash: A8F17E706083118BCB25CF5AC580A3AB7E6FF98718F15493EF486CB291E734E991DB52

Uniqueness

Uniqueness Score: -1.00%

Function 049F20A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E049F20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x4ab8714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E049F2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E049F2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E049C58EC(_t240);
									_t221 =  *0x4ab5cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x4ab5cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E04A04A2C(0x4ab6e40, 0x4a04b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E049E7D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x49a5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E049FF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E049FF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E04A47016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L049E2400(_t267 + 0x20);
															}
															L049E2400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E049F2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E049E2280(_t134, 0x4ab8608);
									__eflags =  *0x4ab6e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E049DFFB0(_t198, _t241, 0x4ab8608);
										__eflags = _t253;
										if(_t253 != 0) {
											L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x4ab6e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x4ab8608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E049F6B90(_t210,  &_v64);
										_t262 =  *0x4ab8608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E049FE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E04A097C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E04A0006A(0x4ab8608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x4ab8608);
												E04A0B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x4ab6904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x4ab6e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E049DFFB0(_t198, _t240, 0x4ab8608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E04A000C2(0x4ab8608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x049f20a0
0x049f20a8
0x049f20ad
0x049f20b3
0x049f20b8
0x049f20c2
0x049f20c7
0x049f20cb
0x049f20d2
0x049f2263
0x049f2266
0x04a35836
0x04a35836
0x00000000
0x049f226c
0x049f226c
0x049f2270
0x049f2274
0x049f20e2
0x049f20e2
0x049f20e6
0x049f20ee
0x04a357dc
0x04a357de
0x04a357ec
0x04a357ec
0x04a357f1
0x04a357f3
0x04a357f8
0x00000000
0x04a357f8
0x04a357e0
0x04a357e4
0x04a357ea
0x00000000
0x00000000
0x00000000
0x04a357ea
0x049f20f4
0x049f20f4
0x049f20f8
0x049f20f8
0x049f20fc
0x049f2100
0x049f2106
0x049f2201
0x049f2206
0x049f220b
0x049f220e
0x049f22a9
0x049f22ac
0x00000000
0x00000000
0x049f22b2
0x049f22b5
0x04a35801
0x04a35806
0x00000000
0x00000000
0x04a35810
0x04a35815
0x04a35818
0x00000000
0x00000000
0x04a3581e
0x049f22bb
0x049f22bb
0x049f2218
0x049f2218
0x049f221c
0x049f2220
0x049f2222
0x049f22c2
0x049f22c4
0x049f22dc
0x049f22dc
0x049f22e1
0x00000000
0x00000000
0x00000000
0x049f22e7
0x049f22c8
0x049f22cd
0x049f22d3
0x049f22d6
0x04a35823
0x04a35825
0x04a35827
0x00000000
0x00000000
0x04a3582d
0x00000000
0x04a3582d
0x00000000
0x049f2228
0x049f2228
0x00000000
0x049f2228
0x049f2222
0x049f2214
0x049f2214
0x00000000
0x049f2114
0x049f2114
0x049f2114
0x049f211a
0x049f211c
0x049f2348
0x049f234d
0x04a35840
0x04a35845
0x04a35848
0x04a3584e
0x04a3584e
0x04a35848
0x049f2353
0x049f2355
0x049f2388
0x049f2388
0x049f2368
0x049f236a
0x049f236c
0x049f238f
0x00000000
0x049f236e
0x049f236e
0x049f218e
0x049f218e
0x049f2191
0x049f2195
0x04a35a03
0x04a35a06
0x04a35a0c
0x04a35a0f
0x04a35a11
0x04a35a13
0x04a35a13
0x04a35a19
0x04a35a1f
0x00000000
0x049f219b
0x049f219b
0x049f21a0
0x049f2282
0x049f2284
0x049f2284
0x049f2284
0x049f2284
0x049f21a6
0x049f21a9
0x049f21ac
0x049f21ae
0x049f21b3
0x049f228b
0x049f2290
0x049f2379
0x049f2296
0x049f2298
0x049f2298
0x049f2290
0x049f21b9
0x049f21be
0x049f22a2
0x049f22a2
0x049f21c4
0x049f21c8
0x049f21cc
0x049f21d0
0x049f21d4
0x049f21de
0x049f21e3
0x04a35a29
0x04a35a2c
0x00000000
0x00000000
0x04a35a3b
0x00000000
0x049f21e9
0x049f21e9
0x049f21e9
0x049f21ee
0x049f21f1
0x04a35a45
0x04a35a4b
0x04a35a52
0x04a35a58
0x04a35a5d
0x04a35a5f
0x04a35a71
0x04a35a61
0x04a35a6a
0x04a35a6a
0x04a35a76
0x04a35a79
0x04a35a7f
0x04a35a83
0x04a35a85
0x04a35a87
0x04a35a87
0x04a35a8c
0x04a35a91
0x04a35a97
0x04a35a9f
0x04a35aa0
0x04a35aa1
0x04a35aa6
0x04a35aab
0x04a35ab1
0x04a35ab3
0x04a35ab9
0x04a35aca
0x04a35ad4
0x04a35ad4
0x04a35ade
0x04a35ade
0x04a35aab
0x04a35a79
0x04a35a52
0x049f21f7
0x049f21f9
0x049f21fe
0x049f21fe
0x049f21e3
0x049f2195
0x049f236c
0x049f2122
0x049f2122
0x049f2124
0x049f2231
0x049f2236
0x049f2236
0x049f2238
0x049f2238
0x049f2240
0x049f2242
0x049f2244
0x04a359fc
0x049f218c
0x049f218c
0x00000000
0x049f218c
0x049f224a
0x049f224f
0x049f2256
0x049f2304
0x049f2309
0x049f230f
0x049f231e
0x049f231e
0x049f231e
0x049f2320
0x049f2325
0x049f232a
0x049f232c
0x049f233e
0x049f233e
0x00000000
0x049f232c
0x049f2311
0x049f2317
0x049f231a
0x049f231c
0x049f2380
0x049f2380
0x049f2380
0x049f2384
0x00000000
0x00000000
0x049f2386
0x00000000
0x049f231c
0x049f225c
0x049f225c
0x00000000
0x049f225c
0x049f212a
0x049f2134
0x049f2138
0x049f213d
0x04a35858
0x04a35863
0x04a35863
0x04a35867
0x04a3586a
0x00000000
0x00000000
0x04a3586c
0x04a3586c
0x04a35871
0x04a35875
0x04a35877
0x04a35997
0x04a3599c
0x04a359a1
0x04a359a7
0x04a359a7
0x00000000
0x04a359a7
0x04a3587d
0x00000000
0x04a3588b
0x04a3588b
0x04a35890
0x04a35892
0x04a35894
0x04a35899
0x04a3589b
0x04a358a0
0x04a358a0
0x04a358aa
0x04a358b2
0x04a358b6
0x04a358be
0x04a358c6
0x04a358c9
0x04a3590d
0x04a35917
0x04a3591a
0x04a3591c
0x04a35920
0x04a35928
0x04a3592a
0x04a3592c
0x04a3592e
0x04a3592e
0x04a358cb
0x04a358cd
0x04a358d8
0x04a358e0
0x04a358f4
0x04a358fe
0x04a358fe
0x04a3593a
0x04a3593e
0x04a35940
0x04a35942
0x00000000
0x04a35944
0x04a35944
0x04a35949
0x04a3594e
0x04a3594e
0x04a35953
0x04a3595b
0x04a35976
0x04a35976
0x04a3597a
0x04a3597f
0x00000000
0x00000000
0x00000000
0x00000000
0x04a35981
0x04a35981
0x04a35981
0x04a35983
0x04a35988
0x04a3598d
0x04a35991
0x04a35991
0x00000000
0x04a3595d
0x04a3595d
0x04a35963
0x04a35965
0x00000000
0x00000000
0x00000000
0x00000000
0x04a35967
0x04a35967
0x04a3596b
0x04a3596d
0x00000000
0x00000000
0x04a3596f
0x04a35971
0x04a35971
0x04a35974
0x00000000
0x00000000
0x00000000
0x04a35974
0x00000000
0x04a35967
0x04a3595b
0x04a35942
0x04a35863
0x049f2143
0x049f2143
0x049f2149
0x049f214f
0x049f22f1
0x049f22f6
0x00000000
0x049f2173
0x049f2173
0x049f217d
0x049f2181
0x049f2186
0x04a359ae
0x04a359b2
0x04a359b5
0x04a359b7
0x04a359ba
0x04a359cd
0x04a359d1
0x04a359d5
0x04a359d9
0x04a359db
0x00000000
0x00000000
0x04a359dd
0x04a359dd
0x04a359e1
0x04a359e4
0x04a359e7
0x04a359ee
0x04a359ee
0x04a359f3
0x04a359f3
0x00000000
0x049f2186
0x049f214f
0x049f2106
0x049f2266
0x049f20d8
0x049f20da
0x049f20e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed283039352bfc2efd8ec94445f8b744bb7ca07502165e9017488542b22942e
Instruction ID: f9034309eb5d4beaca284a6ef6db16a97711696eb68a42beaed6d669aa305730
Opcode Fuzzy Hash: 2ed283039352bfc2efd8ec94445f8b744bb7ca07502165e9017488542b22942e
Instruction Fuzzy Hash: C6F1F771B083419FD725CF6CC840B6A77E6AF85314F04896DFA959B290E775F841CB82

Uniqueness

Uniqueness Score: -1.00%

Function 049DD5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E049DD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x4abd360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E049D6600(0x4ab52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4ab7b9c; // 0x0
							_t281 = L049E4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E04A0F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4ab7b90; // 0x77df0000
								if(_t384 == 0) {
									_t353 =  *0x4ab7b8c; // 0x2dc29e0
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x2dc2a90
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E049E2280(_t200, 0x4ab84d8);
									_t277 =  *0x4ab85f4; // 0x2dc3ea8
									_t351 =  *0x4ab85f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x75080000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x2dc2e20
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x2dc3e40
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x2dc2e20
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x2dc3a98
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E049DFFB0(_t287, _t353, 0x4ab84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E04A1CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E049D6600(0x4ab52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E049D7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x4abb239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E04A4E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4ab8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x4abb218; // 0x0
														asm("ror edi, cl");
														 *0x4abb1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E049E2280(_t250, 0x4ab84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L04A03898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E049DFFB0(_t293, _t353, 0x4ab84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E04A037F5(_t353, 0);
																}
																E04A00413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E049F9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E049F02D6(_t174);
																}
																L049E77F0( *0x4ab7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E049FC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L049DEC7F(_t353);
										L049F19B8(_t287, 0, _t353, 0);
										_t200 = E049CF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E04A0B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x4abb2f8; // 0xc60000
									if((_t206 |  *0x4abb2fc) == 0 || ( *0x4abb2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x4abb2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E04A76B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E04A76AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E049DE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L049DEAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E04A09730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E049DE9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L049D8F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E04A03C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x049dd5f2
0x049dd5f5
0x049dd5f5
0x049dd5fd
0x049dd600
0x049dd60a
0x049dd60d
0x049dd617
0x049dd61d
0x049dd627
0x049dd62e
0x049dd911
0x049dd913
0x00000000
0x049dd919
0x049dd919
0x049dd919
0x049dd634
0x049dd634
0x049dd634
0x049dd634
0x049dd640
0x049dd8bf
0x00000000
0x049dd646
0x049dd646
0x049dd64d
0x049dd652
0x04a2b2fc
0x04a2b2fc
0x04a2b302
0x04a2b33b
0x04a2b341
0x00000000
0x04a2b304
0x04a2b304
0x04a2b319
0x04a2b31e
0x04a2b324
0x04a2b326
0x04a2b332
0x04a2b347
0x04a2b34c
0x04a2b351
0x04a2b35a
0x00000000
0x04a2b328
0x04a2b328
0x00000000
0x04a2b328
0x04a2b326
0x049dd658
0x049dd658
0x049dd65b
0x049dd665
0x00000000
0x049dd66b
0x049dd66b
0x049dd66b
0x049dd66b
0x049dd66d
0x049dd672
0x049dd67a
0x00000000
0x00000000
0x049dd680
0x049dd686
0x049dd8ce
0x049dd8d4
0x049dd8da
0x049dd8dd
0x049dd8dd
0x049dd8e0
0x049dd68c
0x049dd691
0x049dd69d
0x049dd6a2
0x049dd6a7
0x049dd6b0
0x049dd6b0
0x049dd6b5
0x049dd6e0
0x049dd6b7
0x049dd6b7
0x049dd6b9
0x049dd6b9
0x049dd6bb
0x049dd6bd
0x049dd6ce
0x049dd6d0
0x049dd6d2
0x04a2b363
0x04a2b365
0x00000000
0x04a2b36b
0x00000000
0x04a2b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x049dd6bf
0x049dd6bf
0x049dd6e5
0x049dd6e7
0x049dd6e9
0x049dd6e9
0x049dd6ec
0x049dd6ec
0x049dd6ef
0x049dd6f5
0x049dd6f9
0x049dd6fb
0x049dd6fd
0x049dd701
0x049dd703
0x049dd70a
0x049dd70a
0x049dd70a
0x049dd701
0x049dd70d
0x049dd710
0x049dd710
0x049dd6c1
0x049dd6c1
0x049dd6c1
0x049dd6c6
0x04a2b36d
0x04a2b36f
0x00000000
0x04a2b375
0x04a2b375
0x04a2b375
0x00000000
0x04a2b375
0x00000000
0x049dd6cc
0x049dd6d8
0x049dd6d8
0x049dd6d8
0x00000000
0x049dd6c6
0x049dd6bf
0x00000000
0x049dd6da
0x049dd6da
0x049dd716
0x049dd71b
0x049dd720
0x049dd726
0x049dd726
0x049dd72d
0x00000000
0x049dd733
0x049dd739
0x049dd742
0x049dd750
0x049dd758
0x049dd764
0x049dd776
0x049dd77a
0x049dd783
0x049dd928
0x049dd92c
0x049dd93d
0x049dd944
0x049dd94f
0x049dd954
0x049dd956
0x049dd95f
0x049dd961
0x049dd973
0x049dd973
0x049dd956
0x049dd944
0x049dd92c
0x049dd78b
0x04a2b394
0x049dd791
0x049dd798
0x04a2b3a3
0x04a2b3bb
0x04a2b3bb
0x049dd7a5
0x049dd866
0x049dd870
0x049dd884
0x049dd892
0x049dd898
0x049dd89e
0x049dd8a0
0x049dd8a6
0x049dd8ac
0x049dd8ae
0x049dd8b4
0x049dd8b4
0x049dd8ae
0x049dd7a5
0x049dd78b
0x049dd7b1
0x04a2b3c5
0x04a2b3c5
0x049dd7c3
0x049dd7ca
0x049dd7e5
0x049dd7eb
0x049dd8eb
0x049dd8ed
0x00000000
0x049dd8f3
0x049dd8f3
0x049dd8f3
0x00000000
0x049dd8ed
0x049dd7cc
0x049dd7cc
0x049dd7d2
0x00000000
0x049dd7d4
0x049dd7d4
0x049dd7d7
0x049dd7df
0x04a2b3d4
0x04a2b3d9
0x04a2b3dc
0x04a2b3dc
0x04a2b3df
0x04a2b3e2
0x04a2b468
0x04a2b46d
0x04a2b46f
0x04a2b46f
0x04a2b475
0x049dd8f8
0x049dd8f9
0x049dd8fd
0x04a2b3e8
0x04a2b3e8
0x04a2b3eb
0x04a2b3ed
0x00000000
0x04a2b3ef
0x04a2b3ef
0x04a2b3f1
0x04a2b3f4
0x04a2b3fe
0x04a2b404
0x04a2b409
0x04a2b40e
0x04a2b410
0x04a2b410
0x04a2b414
0x04a2b414
0x04a2b41b
0x04a2b420
0x04a2b423
0x04a2b425
0x04a2b427
0x04a2b42a
0x04a2b42d
0x04a2b42d
0x04a2b42a
0x04a2b432
0x04a2b436
0x04a2b438
0x04a2b43b
0x04a2b43b
0x04a2b449
0x04a2b44e
0x04a2b454
0x04a2b458
0x04a2b458
0x04a2b45d
0x00000000
0x04a2b45d
0x04a2b3ed
0x00000000
0x00000000
0x00000000
0x049dd7df
0x049dd7d2
0x049dd7ca
0x04a2b37c
0x04a2b37e
0x04a2b385
0x04a2b38a
0x00000000
0x04a2b38a
0x049dd742
0x049dd7f1
0x049dd7f8
0x04a2b49b
0x04a2b49b
0x049dd800
0x049dd837
0x049dd843
0x049dd845
0x049dd847
0x049dd84a
0x049dd84b
0x049dd84e
0x049dd857
0x049dd802
0x049dd802
0x049dd80d
0x00000000
0x049dd818
0x049dd818
0x049dd824
0x049dd831
0x04a2b4a5
0x04a2b4ab
0x04a2b4b3
0x04a2b4b8
0x04a2b4bb
0x00000000
0x04a2b4c1
0x04a2b4c1
0x04a2b4c8
0x00000000
0x04a2b4ce
0x04a2b4d4
0x04a2b4e1
0x04a2b4e3
0x04a2b4e5
0x00000000
0x04a2b4eb
0x04a2b4f0
0x04a2b4f2
0x049ddac9
0x049ddacc
0x049ddacf
0x049ddad1
0x049ddd78
0x049ddd78
0x049ddcf2
0x00000000
0x049ddad7
0x049ddad9
0x049ddadb
0x00000000
0x00000000
0x049ddae1
0x049ddae1
0x049ddae4
0x049ddae6
0x04a2b4f9
0x04a2b4f9
0x04a2b500
0x049ddaec
0x049ddaec
0x049ddaf5
0x049ddaf8
0x049ddafb
0x049ddb03
0x049ddb11
0x049ddb16
0x049ddb19
0x049ddb1b
0x04a2b52c
0x04a2b531
0x04a2b534
0x049ddb21
0x049ddb21
0x049ddb24
0x049ddcd9
0x049ddce2
0x049ddce5
0x049ddd6a
0x049ddd6d
0x00000000
0x049ddd73
0x04a2b51a
0x04a2b51c
0x04a2b51f
0x04a2b524
0x00000000
0x04a2b524
0x049ddce7
0x049ddce7
0x049ddce7
0x00000000
0x049ddce7
0x00000000
0x049ddb2a
0x049ddb2c
0x049ddb31
0x049ddb33
0x049ddb36
0x049ddb39
0x049ddb3b
0x049ddb66
0x049ddb66
0x049ddb3d
0x049ddb3d
0x049ddb3e
0x049ddb46
0x049ddb47
0x049ddb49
0x049ddb4c
0x049ddb53
0x049ddb55
0x049ddb58
0x049ddb5a
0x04a2b50a
0x04a2b50f
0x04a2b512
0x049ddb60
0x049ddb60
0x049ddb63
0x049ddb63
0x00000000
0x049ddb63
0x049ddb5a
0x049ddb3b
0x049ddb24
0x049ddb69
0x049ddb69
0x049ddb6c
0x049ddb6f
0x049ddb74
0x04a2b557
0x04a2b557
0x04a2b55e
0x049ddb7a
0x049ddb7c
0x049ddb7f
0x049ddb82
0x049ddb85
0x00000000
0x049ddb8b
0x049ddb8b
0x049ddb8d
0x049ddb9b
0x049ddb9b
0x049ddb9d
0x049ddba0
0x049ddba2
0x049ddba4
0x049ddba7
0x049ddba9
0x049ddbae
0x049ddbae
0x049ddbb1
0x049ddbb4
0x049ddbb4
0x049ddbb7
0x049ddbba
0x049ddcd2
0x049ddcd4
0x00000000
0x049ddbc0
0x049ddbc0
0x049ddbd2
0x049ddbd7
0x049ddbda
0x049ddbdd
0x049ddbdf
0x00000000
0x049ddbe5
0x049ddbe5
0x049ddbee
0x049ddbf1
0x04a2b541
0x04a2b544
0x00000000
0x04a2b546
0x04a2b546
0x00000000
0x04a2b546
0x049ddbf7
0x049ddbf7
0x049ddbfd
0x049ddbfd
0x049ddbff
0x049ddc0b
0x049ddc15
0x049ddc1b
0x049ddc1d
0x049ddc21
0x049ddc21
0x049ddc23
0x049ddc23
0x049ddc26
0x049ddc29
0x049ddc2b
0x00000000
0x00000000
0x049ddc31
0x049ddc34
0x049ddc36
0x049ddcbf
0x049ddcbf
0x049ddcc2
0x00000000
0x049ddc3c
0x049ddc41
0x049ddc43
0x00000000
0x049ddc45
0x049ddc45
0x049ddc47
0x00000000
0x049ddc4d
0x049ddc4d
0x049ddc50
0x049ddc52
0x049ddc55
0x049ddcfa
0x049ddcfe
0x049ddd08
0x049ddd0a
0x049ddd0c
0x00000000
0x049ddd12
0x049ddd15
0x049ddd2d
0x049ddd2f
0x049ddd32
0x049ddd35
0x00000000
0x049ddd35
0x049ddc5b
0x049ddc5b
0x049ddc5e
0x049ddc61
0x049ddc64
0x049ddc67
0x049ddc67
0x049ddc6a
0x049ddc6c
0x049ddc8e
0x049ddc8e
0x049ddc91
0x049ddc93
0x049ddcce
0x049ddcce
0x049ddc95
0x049ddc9c
0x049ddc6e
0x049ddc72
0x049ddc75
0x049ddc77
0x049ddc79
0x04a2b551
0x04a2b551
0x00000000
0x049ddc7f
0x049ddc7f
0x049ddc81
0x00000000
0x049ddc83
0x049ddc86
0x049ddc88
0x00000000
0x00000000
0x00000000
0x00000000
0x049ddc88
0x049ddc81
0x049ddc79
0x049ddc6c
0x049ddc55
0x049ddc47
0x049ddc43
0x00000000
0x049ddc36
0x049ddc23
0x00000000
0x049ddbff
0x049ddbf1
0x049ddbdf
0x049ddb8f
0x049ddb92
0x049ddb95
0x00000000
0x00000000
0x00000000
0x00000000
0x049ddb95
0x049ddb8d
0x049ddb85
0x049ddb74
0x049ddc9f
0x049ddca2
0x049ddcb0
0x049ddcb0
0x049ddad1
0x04a2b4e5
0x04a2b4c8
0x00000000
0x00000000
0x00000000
0x049dd831
0x049dd80d
0x00000000
0x049dd800
0x04a2b47f
0x04a2b485
0x00000000
0x04a2b485
0x049dd665
0x049dd652
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df9ebdd2864eeab32148297c35947b987f048b960e480b6cba8559126234c1b
Instruction ID: 3bba97a28dbdbdfe8c4e443a432ce97c033a5c26b328d74e2459412be5178331
Opcode Fuzzy Hash: 9df9ebdd2864eeab32148297c35947b987f048b960e480b6cba8559126234c1b
Instruction Fuzzy Hash: 64E1A170A007598FEB25DF28C980BA9B7B6BF85304F0482F9D9099B291D774BD81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 049D849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E049D849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x4a9f9c0);
				E04A1D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4ab7b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E049DCEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E049E2280( *[fs:0x30], 0x4ab8550);
						_t139 =  *0x4ab7b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E049FF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E049DFFB0(_t193, _t235, 0x4ab8550);
								L5:
								return E04A1D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E049C1C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4ab7b9c; // 0x0
							_t235 = L049E4620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4ab7b10; // 0x8
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E049FA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E049DFFB0(_t193, _t235, 0x4ab8550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L049E77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L049E77F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4ab7b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4ab7b10; // 0x8
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E04A037C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4ab7b9c; // 0x0
									_t214 = L049E4620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E04A037F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4ab7b10 =  *0x4ab7b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4ab7b04 =  *0x4ab7b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L049E77F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L049E77F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4ab7b08 =  *0x4ab7b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E04A057C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E04A0F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L049E77F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E049FA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L049E77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E04A096C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x049d849b
0x049d849b
0x049d849b
0x049d849b
0x049d849d
0x049d84a2
0x049d84a7
0x049d84b1
0x049d84d8
0x00000000
0x049d84b3
0x049d84c4
0x049d84c9
0x049d84cd
0x049d84cf
0x049d84cf
0x049d84d6
0x049d84e6
0x049d84e9
0x049d84ec
0x049d84ef
0x049d84f2
0x049d84f4
0x049d84fc
0x049d8501
0x049d8506
0x049d8509
0x049d86e0
0x049d86e5
0x049d86e8
0x049d86ed
0x049d86f0
0x049d86f2
0x04a29afd
0x04a29b02
0x049d84da
0x049d84df
0x049d84df
0x049d86fa
0x049d86fd
0x049d86fe
0x049d8701
0x049d8706
0x049d8709
0x049d870b
0x00000000
0x00000000
0x049d8711
0x049d8725
0x049d8727
0x049d872a
0x049d872c
0x04a29af0
0x04a29af5
0x049d8732
0x049d8732
0x049d8732
0x049d8735
0x049d8737
0x049d8515
0x049d8515
0x049d8518
0x049d851d
0x049d8523
0x049d8527
0x049d852b
0x049d8537
0x049d8539
0x049d853c
0x049d853e
0x049d868c
0x049d8691
0x049d8699
0x049d869b
0x049d8744
0x049d8748
0x049d86a1
0x049d86a1
0x049d86a1
0x049d86a4
0x049d86a8
0x04a29bdf
0x04a29bdf
0x049d86ae
0x049d86b0
0x00000000
0x049d86b6
0x00000000
0x04a29be9
0x049d86b0
0x049d8544
0x049d854a
0x049d854d
0x049d8551
0x049d876e
0x049d8778
0x049d877b
0x049d8780
0x049d8557
0x049d8557
0x049d855d
0x049d855d
0x049d856b
0x049d856e
0x049d8570
0x049d8573
0x049d8576
0x049d8576
0x049d8579
0x049d857b
0x00000000
0x00000000
0x049d8581
0x049d85a0
0x049d85a2
0x049d85a5
0x049d85a7
0x04a29b1b
0x04a29b1b
0x049d862e
0x049d862e
0x049d8631
0x049d8631
0x049d8634
0x049d8636
0x049d8669
0x049d8669
0x049d866b
0x04a29bbf
0x04a29bc4
0x04a29bc8
0x04a29bce
0x04a29bce
0x049d8671
0x049d8671
0x049d8674
0x049d8676
0x04a29bae
0x04a29bae
0x049d8676
0x049d867c
0x049d867e
0x049d8688
0x049d8688
0x00000000
0x049d867e
0x049d8638
0x049d8638
0x049d863b
0x049d863e
0x049d863f
0x049d8642
0x049d8645
0x049d8648
0x049d864d
0x04a29b69
0x04a29b6e
0x04a29b7b
0x04a29b81
0x04a29b85
0x04a29b89
0x04a29ba7
0x04a29b8b
0x04a29b91
0x04a29b9a
0x04a29b9f
0x04a29b9f
0x049d8788
0x049d878d
0x049d8763
0x049d8763
0x049d8766
0x00000000
0x049d8766
0x04a29b70
0x00000000
0x04a29b70
0x049d8656
0x049d865a
0x049d865c
0x049d8752
0x049d8756
0x00000000
0x00000000
0x049d875e
0x00000000
0x049d875e
0x049d8662
0x049d8662
0x049d8662
0x049d8666
0x00000000
0x049d8666
0x049d85b7
0x049d85b9
0x049d85bc
0x049d85bf
0x049d85cc
0x049d85d1
0x049d85d4
0x049d85db
0x049d85de
0x049d85e0
0x04a29b5f
0x00000000
0x04a29b5f
0x049d85e6
0x049d85ea
0x049d86c3
0x049d86c5
0x049d86c8
0x049d86ca
0x04a29b16
0x00000000
0x04a29b16
0x049d86d6
0x049d85f6
0x049d85f6
0x049d85f9
0x049d8602
0x049d8606
0x049d860a
0x049d860b
0x049d860e
0x049d8611
0x00000000
0x049d8611
0x049d85f3
0x00000000
0x049d85f3
0x049d8619
0x049d861e
0x049d861e
0x049d8621
0x049d8622
0x049d8623
0x049d8625
0x049d862c
0x00000000
0x049d873d
0x00000000
0x049d873d
0x049d8737
0x049d850f
0x049d8512
0x00000000
0x049d8512
0x00000000
0x049d84d6

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc41c5fd712eac278c0c375c5713b95f2a69043fb4b0711cc6f581d3ce6c67a5
Instruction ID: f67542b508e6785f3b9adfb0c0d2324ff7d1aed1c68adc902dcbb9fca6f7194c
Opcode Fuzzy Hash: dc41c5fd712eac278c0c375c5713b95f2a69043fb4b0711cc6f581d3ce6c67a5
Instruction Fuzzy Hash: C3B16DB4F00209DFDB19DF99C980AAEBBB9FF88704F108529E415AB256D770B941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 049F513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E049F513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x4abd360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E04A0D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E049E2280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L049E4620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E04A0F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E049DFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x4abb1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E04A0B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x049f5142
0x049f514c
0x049f5150
0x049f5157
0x049f5159
0x049f515e
0x049f5165
0x049f5169
0x049f516c
0x049f5172
0x049f5176
0x049f517a
0x049f517a
0x049f517a
0x049f517f
0x04a36d8b
0x04a36d8e
0x04a36d91
0x04a36d95
0x04a36d98
0x04a36d9c
0x04a36da0
0x04a36da3
0x04a36da7
0x04a36e26
0x04a36e26
0x04a36e2a
0x049f51f9
0x049f51f9
0x049f51fe
0x04a36e33
0x04a36e33
0x04a36e39
0x04a36e3d
0x04a36e46
0x04a36e50
0x00000000
0x00000000
0x04a36e52
0x04a36e53
0x04a36e56
0x04a36e5d
0x00000000
0x00000000
0x00000000
0x04a36e5f
0x04a36e67
0x04a36e77
0x04a36e7f
0x04a36e80
0x04a36e88
0x04a36e90
0x04a36e9f
0x04a36ea5
0x04a36ea9
0x04a36eb1
0x04a36ebf
0x00000000
0x00000000
0x04a36ecf
0x04a36ed3
0x00000000
0x00000000
0x04a36edb
0x04a36ede
0x04a36ee1
0x04a36ee8
0x04a36eeb
0x04a36eed
0x04a36ef0
0x04a36ef4
0x04a36ef8
0x04a36efc
0x00000000
0x00000000
0x04a36f0d
0x04a36f11
0x04a36f32
0x04a36f37
0x04a36f3b
0x04a36f3e
0x04a36f41
0x04a36f46
0x00000000
0x00000000
0x04a36f4c
0x04a36f50
0x04a36f50
0x04a36f54
0x04a36f62
0x04a36f65
0x04a36f6d
0x04a36f7b
0x04a36f7b
0x04a36f93
0x04a36f98
0x04a36fa0
0x04a36fa6
0x04a36fb3
0x04a36fb6
0x04a36fbf
0x04a36fc1
0x04a36fd5
0x04a36fda
0x04a36fda
0x04a36fdd
0x04a36fe2
0x04a36fe7
0x04a36feb
0x04a36fef
0x04a36ff3
0x049f520c
0x049f520c
0x049f520f
0x049f5215
0x049f5234
0x049f523a
0x049f523a
0x049f5244
0x049f5245
0x049f5246
0x049f5251
0x049f5251
0x04a36f13
0x04a36f17
0x04a36f17
0x04a36f18
0x04a36f1b
0x04a36f1f
0x04a36f23
0x00000000
0x04a36f28
0x049f5204
0x049f5204
0x049f5208
0x00000000
0x049f5208
0x049f5185
0x049f5188
0x049f518a
0x049f518e
0x049f5195
0x04a36db1
0x04a36db5
0x04a36db9
0x049f519b
0x049f519b
0x049f519e
0x049f51a7
0x049f51a9
0x049f51a9
0x049f51b5
0x049f51b8
0x049f51bb
0x049f51be
0x049f51c1
0x049f51c5
0x049f51c9
0x049f51cd
0x049f51cd
0x049f51d8
0x049f51dc
0x049f51e0
0x04a36dcc
0x04a36dd0
0x04a36dd5
0x04a36ddd
0x04a36de1
0x04a36de1
0x04a36de5
0x04a36deb
0x04a36df1
0x04a36df7
0x04a36dfd
0x04a36e01
0x04a36e05
0x04a36e09
0x04a36e0d
0x04a36e11
0x04a36e11
0x049f51eb
0x04a36e1a
0x04a36e1f
0x04a36e21
0x04a36e23
0x00000000
0x049f51f1
0x049f51f1
0x00000000
0x049f51f1

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594fb8dc12d2239fcedacfad3a269c429c8fc06b8b6ce789005c84b30d38a3d8
Instruction ID: 5181cf6aff93611f89641012c59b7da25b3cfdd0dd579131c6f3b8856b3df459
Opcode Fuzzy Hash: 594fb8dc12d2239fcedacfad3a269c429c8fc06b8b6ce789005c84b30d38a3d8
Instruction Fuzzy Hash: 1BC124756083809FD364CF28C580A5AFBF1BF88314F188A6EF9998B352D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 049F03E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E049F03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x4abd360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E049F0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E04A0B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E049DB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4ab7c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E049E7D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E049E7D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E04A47016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E04A09830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E04A469A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4ab7c04 != 0) {
						_t118 = _v12;
						_t120 = E04A4A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4ab7bd8;
						if( *0x4ab7bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E04A095D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E04A099A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E04A43540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E049CB1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E04A0AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4ab8474 - 3;
										if( *0x4ab8474 != 3) {
											 *0x4ab79dc =  *0x4ab79dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E049E7D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E049E7D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E04A47016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4ab8708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4ab7b00; // 0x0
							asm("ror esi, cl");
							 *0x4abb1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E04A095D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E049D7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x049f03f1
0x049f03f7
0x049f03f9
0x049f03fb
0x049f03fd
0x049f0400
0x049f040a
0x04a34c7a
0x049f0537
0x049f0547
0x049f0410
0x049f0410
0x049f0414
0x049f0417
0x049f041a
0x049f0421
0x049f0424
0x049f042b
0x049f043b
0x049f043e
0x049f043f
0x049f043f
0x049f0446
0x049f0449
0x049f044c
0x049f044f
0x049f0459
0x04a34c8d
0x049f045f
0x049f045f
0x049f045f
0x049f0467
0x04a34c97
0x04a34c9d
0x04a34ca4
0x04a34caa
0x04a34caf
0x04a34cb1
0x04a34cc3
0x04a34cb3
0x04a34cbc
0x04a34cbc
0x04a34cc8
0x04a34ccb
0x04a34cd7
0x04a34cda
0x04a34cdf
0x04a34cdf
0x04a34ccb
0x04a34ca4
0x049f046d
0x049f046f
0x049f046f
0x049f0471
0x049f0476
0x049f047a
0x049f047b
0x049f0483
0x049f0489
0x049f048d
0x00000000
0x00000000
0x04a34ce9
0x04a34cef
0x04a34d22
0x04a34d22
0x00000000
0x04a34d22
0x04a34cf1
0x04a34cf7
0x00000000
0x00000000
0x04a34cf9
0x04a34cff
0x00000000
0x00000000
0x04a34d05
0x04a34d07
0x00000000
0x00000000
0x04a34d0d
0x04a34d0f
0x04a34d14
0x04a34d16
0x00000000
0x00000000
0x04a34d1c
0x04a34d1c
0x049f0499
0x049f0535
0x049f0535
0x00000000
0x049f0535
0x049f04a6
0x04a34d2c
0x04a34d37
0x04a34d39
0x04a34d3b
0x00000000
0x00000000
0x04a34d41
0x04a34d48
0x049f0527
0x049f052b
0x049f052d
0x049f0530
0x049f0530
0x00000000
0x049f052b
0x04a34d4e
0x049f04ac
0x049f04ac
0x049f04af
0x049f04b2
0x049f04b7
0x049f04b9
0x049f04bb
0x049f04bd
0x049f04bf
0x049f04c5
0x049f04c9
0x04a34d53
0x04a34d59
0x04a34db9
0x04a34dba
0x04a34dbf
0x04a34dc2
0x04a34dc4
0x04a34dc7
0x04a34dce
0x00000000
0x04a34dce
0x04a34d5b
0x04a34d61
0x00000000
0x00000000
0x04a34d63
0x04a34d69
0x00000000
0x00000000
0x04a34d6b
0x04a34d6e
0x04a34d74
0x04a34d76
0x04a34d7c
0x04a34d7e
0x04a34d84
0x04a34d89
0x04a34d8c
0x04a34d8d
0x04a34d92
0x04a34d95
0x04a34d96
0x04a34d98
0x04a34d9a
0x04a34d9f
0x04a34da4
0x04a34da6
0x04a34da8
0x04a34daf
0x04a34db1
0x04a34db1
0x04a34daf
0x04a34da6
0x04a34d84
0x04a34d7c
0x00000000
0x04a34d74
0x049f04d6
0x04a34de1
0x049f04dc
0x049f04dc
0x049f04dc
0x049f04e4
0x04a34deb
0x04a34df1
0x04a34df8
0x04a34dfe
0x04a34e03
0x04a34e05
0x04a34e17
0x04a34e07
0x04a34e10
0x04a34e10
0x04a34e1c
0x04a34e1f
0x04a34e35
0x04a34e35
0x04a34e1f
0x04a34df8
0x049f04f1
0x049f04fa
0x04a34e3f
0x04a34e47
0x04a34e5b
0x04a34e61
0x04a34e67
0x04a34e69
0x04a34e71
0x04a34e73
0x049f0500
0x049f0500
0x049f0500
0x049f04fa
0x049f0508
0x049f051d
0x049f051d
0x049f051f
0x049f0524
0x00000000
0x049f0524
0x049f0515
0x049f0517
0x04a34e7a
0x04a34e7c
0x00000000
0x00000000
0x04a34e85
0x00000000
0x04a34e85
0x00000000
0x049f0517

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b0e603bb8e463a6a36fb4b52a24419bf9c944487ca85e6d01762e2c1c7971c
Instruction ID: 6dc024df6a243fa0cc605db763a825dd6be3096350d14ae73366421cbe63314f
Opcode Fuzzy Hash: 00b0e603bb8e463a6a36fb4b52a24419bf9c944487ca85e6d01762e2c1c7971c
Instruction Fuzzy Hash: C4910431E00218AFEB319B69CD44BAD7BA9EB45768F050275FA11AB2D2F774BC40C791

Uniqueness

Uniqueness Score: -1.00%

Function 049CC600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E049CC600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x4abd360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E049D6D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E04A0B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4ab7b9c; // 0x0
					_t74 = L049E4620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E04A09650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L049E77F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E04A0F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E04A013C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L049E77F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E04A09650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x049cc608
0x049cc615
0x049cc625
0x049cc62d
0x049cc635
0x049cc640
0x049cc680
0x049cc687
0x049cc688
0x049cc689
0x049cc694
0x049cc694
0x049cc642
0x049cc64a
0x049cc697
0x04a37a25
0x04a37a2b
0x04a37a2e
0x04a37a30
0x04a37bea
0x04a37bea
0x00000000
0x04a37bea
0x04a37a36
0x04a37a43
0x04a37a48
0x04a37a4c
0x04a37a4e
0x00000000
0x00000000
0x04a37a58
0x04a37a5a
0x04a37a5b
0x04a37a5c
0x04a37a5d
0x04a37a63
0x04a37a64
0x04a37a6a
0x04a37a6c
0x04a37a6e
0x04a379cb
0x04a379cb
0x04a379ce
0x04a379d0
0x04a37a98
0x04a37a9b
0x04a37a9b
0x04a37a9e
0x04a37aa1
0x04a37bbe
0x04a37bbe
0x04a37bc0
0x04a37be0
0x04a37be0
0x04a37a01
0x04a37a01
0x04a37a05
0x04a37a07
0x04a37a15
0x04a37a15
0x04a37a1a
0x00000000
0x04a37a1a
0x04a37bc2
0x04a37bc6
0x04a37bc9
0x04a37bcd
0x04a37bcf
0x04a379e6
0x04a379e6
0x04a379eb
0x04a379eb
0x04a379ef
0x04a379f1
0x00000000
0x00000000
0x04a379f3
0x04a379f5
0x04a379ff
0x04a379ff
0x00000000
0x04a379ff
0x04a379f7
0x04a379fd
0x00000000
0x00000000
0x00000000
0x04a379fd
0x04a37bd5
0x04a37bd8
0x00000000
0x00000000
0x04a37ba9
0x04a37bac
0x04a37bb0
0x04a37bb1
0x04a37bb1
0x04a37bb6
0x00000000
0x04a37bb6
0x04a37aa7
0x04a37aaa
0x00000000
0x00000000
0x04a37ab2
0x04a37ab3
0x04a37ab5
0x04a37aec
0x04a37aef
0x04a37b25
0x04a37b28
0x04a37b62
0x04a37b64
0x04a37b8f
0x04a37b92
0x04a37b96
0x04a37b98
0x00000000
0x00000000
0x04a37b9e
0x04a37b9f
0x04a37ba3
0x00000000
0x04a37ba3
0x04a37b66
0x04a37b68
0x04a37ae2
0x04a37ae2
0x00000000
0x04a37ae2
0x04a37b6e
0x04a37b72
0x04a37b75
0x04a37b81
0x04a37b85
0x04a37b87
0x00000000
0x00000000
0x04a37b31
0x04a37b34
0x04a37b3c
0x04a37b45
0x04a37b46
0x04a37b4f
0x04a37b51
0x04a37b57
0x04a37b59
0x04a37b59
0x00000000
0x04a37b59
0x04a37b77
0x00000000
0x04a37b77
0x04a37b2a
0x00000000
0x04a37b2a
0x04a37af1
0x04a37af3
0x00000000
0x00000000
0x04a37afb
0x04a37afc
0x04a37afe
0x00000000
0x00000000
0x04a37b00
0x04a37b03
0x00000000
0x00000000
0x04a37b05
0x04a37b09
0x04a37b0d
0x04a37b0f
0x00000000
0x00000000
0x04a37b18
0x04a37b1d
0x00000000
0x04a37b1d
0x04a37ab7
0x04a37ab9
0x00000000
0x00000000
0x04a37abf
0x04a37ac1
0x00000000
0x00000000
0x04a37ac3
0x04a37ac6
0x00000000
0x00000000
0x04a37ac8
0x04a37acc
0x04a37ad0
0x04a37ad2
0x00000000
0x00000000
0x04a37adb
0x00000000
0x04a37adb
0x04a379d6
0x04a379d9
0x04a379dc
0x04a37a91
0x04a37a94
0x00000000
0x04a37a94
0x04a379e2
0x00000000
0x04a379e2
0x04a37a74
0x04a37a7a
0x00000000
0x00000000
0x04a37a8a
0x04a37a21
0x04a37a21
0x00000000
0x04a37a21
0x049cc650
0x049cc651
0x049cc656
0x049cc65c
0x049cc65d
0x049cc663
0x049cc664
0x049cc66a
0x049cc66e
0x04a379c5
0x04a379c7
0x00000000
0x04a379c7
0x049cc67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ee562315154760981f6825e137ad54500b09e44df64c2cd6ab1dd1efa9d2edd5
Instruction ID: a52a48cc843b134b921df2ff53638b337dc1607e5d9ed4d89d4b43e182110fac
Opcode Fuzzy Hash: ee562315154760981f6825e137ad54500b09e44df64c2cd6ab1dd1efa9d2edd5
Instruction Fuzzy Hash: B2817EBDA442029FDB25CF14C880A7AB7A5EB84355F54C96AFD469B640F330FD41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A46DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E04A46DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E04A46B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E049E7D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E04A09AE0();
					_t87 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E04A4795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E04A4795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E04A4795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E04A4795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L049E4620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E04A46B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E04A46B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E04A46B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E04A46B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E049E7D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E04A09AE0();
								L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L049E2400( &_v36);
							if(_v24 >= 0) {
								_t87 = L049E2400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L049E2400( &_v52);
							}
							if(_v28 >= 0) {
								return L049E2400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x04a46dd4
0x04a46dde
0x04a46de1
0x04a46de3
0x04a46de6
0x04a46de9
0x04a46dec
0x04a46def
0x04a46df2
0x04a46df5
0x04a46dfe
0x04a46e04
0x04a46e09
0x04a46e0d
0x04a46e18
0x04a46e1b
0x04a46e22
0x04a46e2d
0x04a46e30
0x04a46e36
0x04a46e42
0x04a46e4d
0x04a46e50
0x04a46e55
0x04a46e5c
0x04a46e6e
0x04a46e5e
0x04a46e67
0x04a46e67
0x04a46e73
0x04a46e74
0x04a46e77
0x04a46e7c
0x04a46e7d
0x04a46e8e
0x04a46e93
0x04a46e9c
0x04a46ea8
0x04a46eab
0x04a46eac
0x04a46eb3
0x04a46ecd
0x04a46edc
0x04a46ee2
0x04a46ee5
0x04a46ef2
0x04a46efb
0x04a46f01
0x04a46f06
0x04a46f0b
0x04a46f11
0x04a46f1a
0x04a46f22
0x04a46f26
0x04a46f26
0x04a46f33
0x04a46f41
0x04a46f44
0x04a46f47
0x04a46f54
0x04a46f65
0x04a46f77
0x04a46f7c
0x04a46f82
0x04a46f91
0x04a46f99
0x04a46fa3
0x04a46fae
0x04a46fae
0x04a46fba
0x04a46fbb
0x04a46fbc
0x04a46fc1
0x04a46fc2
0x04a46fd3
0x04a46fd8
0x04a46fd8
0x04a46fdf
0x04a46fe8
0x04a46fee
0x04a46fee
0x04a46ff5
0x04a46ffb
0x04a46ffb
0x04a47004
0x00000000
0x04a4700a
0x04a47004
0x04a46eb3
0x04a46e9c
0x04a47015

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: f1878ea93521fec9864a21864d232ac21fa5b9fec05e1fbacbf15229e4878b9c
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: EC716B71A00209EFDB11DFA5C984EAEBBB9FFC8714F144569E505A7290DB34FA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A5B8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E04A5B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4ab7b9c; // 0x0
				_t124 = L049E4620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E04A09800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E04A095B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E04A095D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L049E77F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E04A09910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E04A095D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4ab7b9c; // 0x0
									_t92 = L049E4620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E04A09910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E049CA7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E04A5E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E04A5E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E04A095B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x04a5b8d9
0x04a5b8e4
0x00000000
0x04a5b8e6
0x04a5b8f3
0x04a5b8f5
0x04a5b8f5
0x04a5b8f8
0x04a5b920
0x04a5b924
0x04a5b936
0x04a5b939
0x04a5b93d
0x04a5b948
0x04a5b9a0
0x04a5b9a0
0x04a5b9a4
0x04a5b9bf
0x04a5b9c4
0x04a5b9c6
0x04a5b9cd
0x04a5b9d1
0x04a5bad4
0x04a5bad8
0x04a5bada
0x04a5badc
0x04a5badc
0x04a5badf
0x04a5bae0
0x04a5bae2
0x04a5bae4
0x04a5baec
0x04a5baee
0x04a5baf0
0x04a5baf0
0x04a5baec
0x04a5bafb
0x04a5bafc
0x04a5bafe
0x04a5bb01
0x04a5bb01
0x00000000
0x04a5bb06
0x04a5b9d7
0x04a5b9db
0x04a5b9db
0x04a5b9de
0x04a5b9de
0x04a5b9e4
0x04a5b9e7
0x04a5b9ea
0x04a5b9ec
0x04a5b9ef
0x04a5b9f3
0x04a5ba1b
0x04a5ba1b
0x04a5ba23
0x04a5ba24
0x04a5ba27
0x04a5ba2a
0x04a5ba2b
0x04a5ba2e
0x04a5ba30
0x04a5ba37
0x04a5ba3f
0x04a5ba9c
0x04a5baa2
0x04a5bb13
0x04a5bb15
0x04a5baae
0x04a5baae
0x04a5bab3
0x04a5bab5
0x04a5baba
0x04a5bac8
0x04a5bac8
0x04a5baba
0x04a5bacd
0x04a5bacf
0x00000000
0x04a5bacf
0x04a5bb1a
0x00000000
0x04a5bb1c
0x04a5baa7
0x04a5bb11
0x00000000
0x04a5bb11
0x04a5baa9
0x00000000
0x00000000
0x00000000
0x00000000
0x04a5ba41
0x04a5ba41
0x04a5ba41
0x04a5ba58
0x04a5ba5d
0x04a5ba62
0x00000000
0x00000000
0x04a5ba64
0x04a5ba67
0x04a5ba68
0x04a5ba69
0x04a5ba6c
0x04a5ba6f
0x04a5ba71
0x04a5ba78
0x04a5ba80
0x00000000
0x00000000
0x04a5ba90
0x04a5ba90
0x04a5ba97
0x00000000
0x04a5ba97
0x04a5b9f5
0x04a5b9f7
0x04a5b9f7
0x04a5b9fa
0x04a5ba03
0x04a5ba07
0x04a5ba0c
0x04a5ba10
0x04a5ba17
0x00000000
0x04a5b9f7
0x04a5b9a6
0x04a5b9a8
0x04a5b9af
0x04a5b9b3
0x00000000
0x00000000
0x04a5b9b9
0x00000000
0x04a5b9b9
0x04a5b94d
0x04a5b98f
0x04a5b995
0x04a5b999
0x04a5b960
0x04a5b967
0x04a5b968
0x04a5b96a
0x00000000
0x04a5b96a
0x04a5b99b
0x04a5b99e
0x00000000
0x00000000
0x00000000
0x04a5b99e
0x04a5b951
0x04a5b954
0x04a5b95a
0x04a5b95e
0x04a5b972
0x04a5b979
0x04a5b97d
0x04a5b97f
0x04a5b980
0x04a5b982
0x04a5b984
0x00000000
0x04a5b984
0x00000000
0x04a5b926
0x00000000
0x04a5b926

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d2333fc21ec206455123b668a06743056292564e76e01f0375f014a2dab82c
Instruction ID: c5742fc23c1a6491edae100504f6b98cb95d904dc0fb9b9c660a58bf474838b8
Opcode Fuzzy Hash: 69d2333fc21ec206455123b668a06743056292564e76e01f0375f014a2dab82c
Instruction Fuzzy Hash: 74711072200701EFE7328F25CA41F66B7B5EB84725F118928EA558B2F1EB71F940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 049C52A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E049C52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E049DEEF0(0x4ab79a0);
					_t104 =  *0x4ab8210; // 0x2dc2bb0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E049DEB70(_t93, 0x4ab79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E04A09890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E049DEEF0(0x4ab79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E049DEB70(0, 0x4ab79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0xdc2bc802
								_t13 = _t104 + 0xc; // 0x2dc2bbd
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E049FF0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E049DEEF0(0x4ab79a0);
									__eflags =  *0x4ab8210 - _t104; // 0x2dc2bb0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4ab8210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2002dc2b
											_t95 =  *((intOrPtr*)( *_t37));
											E04A44888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E049DEB70(_t95, 0x4ab79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E04A095D0();
											L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E04A095D0();
											L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E049DEB70(_t93, 0x4ab79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E04A095D0();
										L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E04A095D0();
										L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2002dc2b
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0xdc2bc802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E049FF0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x049c52a5
0x049c52ad
0x049c52b0
0x049c52b3
0x049c52b7
0x049c52ba
0x049c52bf
0x049c52c4
0x049c52cc
0x00000000
0x00000000
0x049c52ce
0x049c52d1
0x049c52d9
0x049c52dd
0x049c52e7
0x049c52f7
0x049c52f9
0x049c52fd
0x04a20dcf
0x04a20dd5
0x04a20dd6
0x04a20dd7
0x04a20dd8
0x04a20dd9
0x04a20dde
0x04a20ddf
0x04a20de0
0x04a20de1
0x04a20de2
0x04a20de2
0x04a20de5
0x04a20dea
0x04a20dec
0x04a20f60
0x04a20f64
0x04a20f70
0x04a20f76
0x04a20f79
0x04a20f79
0x00000000
0x04a20f64
0x04a20df2
0x04a20df7
0x04a20e04
0x04a20e04
0x04a20e0d
0x04a20e0d
0x04a20e10
0x04a20e1a
0x04a20e1c
0x04a20e4c
0x04a20e52
0x04a20e61
0x04a20e67
0x04a20e6b
0x04a20e70
0x04a20e76
0x04a20ed7
0x04a20edc
0x04a20ee0
0x04a20ee6
0x04a20eea
0x04a20eed
0x04a20ef0
0x04a20ef3
0x04a20ef6
0x04a20ef9
0x04a20efb
0x04a20efe
0x04a20f01
0x04a20f01
0x04a20f0b
0x04a20f12
0x04a20f16
0x04a20f18
0x04a20f18
0x04a20f1b
0x04a20f2c
0x04a20f31
0x04a20f31
0x04a20f35
0x04a20f39
0x04a20f3a
0x04a20f3c
0x04a20f3c
0x04a20f3f
0x04a20f50
0x04a20f55
0x04a20f55
0x04a20f59
0x049c52eb
0x049c52f1
0x049c52f1
0x04a20e7d
0x04a20e84
0x04a20e88
0x04a20e8a
0x04a20e8a
0x04a20e8d
0x04a20e9e
0x04a20ea3
0x04a20ea3
0x04a20ea7
0x04a20eaf
0x04a20eb3
0x04a20eb9
0x04a20eb9
0x04a20ebc
0x04a20ecd
0x04a20ecd
0x00000000
0x04a20eb3
0x04a20e1e
0x04a20e21
0x04a20e25
0x04a20e2b
0x04a20e2f
0x04a20e30
0x04a20e3a
0x04a20e3f
0x04a20e41
0x00000000
0x00000000
0x04a20e47
0x00000000
0x04a20e47
0x04a20df9
0x04a20dfe
0x00000000
0x00000000
0x00000000
0x04a20dfe
0x049c5303
0x049c5307
0x00000000
0x049c5309
0x00000000
0x049c5309
0x049c5307
0x049c52e9
0x049c52e9
0x00000000
0x049c52e9
0x049c530e
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e578c116dee7611a75077326cb2d24e7432a769da1fe9ec192461803a499c6
Instruction ID: 3bdf901c666048a3844f902b9ce453d00c1c5b82b485a53769c51fb008b8d446
Opcode Fuzzy Hash: 25e578c116dee7611a75077326cb2d24e7432a769da1fe9ec192461803a499c6
Instruction Fuzzy Hash: E5514170205751AFE721EF28C940B27BBE8FF84724F00882EE59587691E7B4F804DB92

Uniqueness

Uniqueness Score: -1.00%

Function 049F2AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049F2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4ab8204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4ab8208; // 0x4ab8207
				_t8 = _t57 + 0x4ab8208; // 0x4ab8207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4ab8450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x4ab821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4ab6d5c; // 0x7f070654
							_t72 =  *0x4ab6d5c; // 0x7f070654
							_t75 =  *0x4ab6d5c; // 0x7f070654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4ab6d5c; // 0x7f070654
							_t84 =  *0x4ab6d5c; // 0x7f070654
							_t87 =  *0x4ab6d5c; // 0x7f070654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E04A0F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x049f2ae4
0x049f2aec
0x049f2aef
0x049f2af4
0x049f2af7
0x049f2afd
0x049f2b92
0x049f2b92
0x049f2b97
0x049f2b9c
0x049f2b9c
0x049f2b03
0x049f2b06
0x049f2b09
0x049f2b09
0x049f2b0f
0x049f2b15
0x049f2b15
0x049f2b1b
0x049f2b1e
0x049f2b21
0x049f2b26
0x049f2b29
0x049f2b81
0x049f2b84
0x049f2c0e
0x049f2c15
0x049f2c24
0x049f2c24
0x049f2b8a
0x049f2b8a
0x049f2b8a
0x049f2b8a
0x049f2b90
0x00000000
0x00000000
0x00000000
0x00000000
0x049f2b4a
0x049f2b4a
0x049f2b4d
0x049f2b53
0x00000000
0x00000000
0x049f2b55
0x049f2b58
0x049f2bb7
0x04a35d1b
0x04a35d37
0x04a35d47
0x04a35d53
0x049f2bbd
0x049f2bbd
0x049f2bbd
0x049f2bb7
0x049f2b5d
0x049f2c2f
0x04a35d5b
0x04a35d77
0x04a35d87
0x04a35d93
0x049f2c35
0x049f2c35
0x049f2c35
0x049f2c2f
0x049f2b65
0x049f2b9f
0x049f2ba2
0x049f2b67
0x049f2b67
0x049f2b69
0x049f2b6b
0x049f2b6e
0x049f2bc9
0x049f2bcc
0x049f2bcf
0x049f2bd4
0x049f2bd6
0x049f2bd6
0x049f2bdb
0x049f2c02
0x049f2c05
0x049f2c07
0x00000000
0x049f2c07
0x049f2be0
0x049f2c00
0x049f2c3f
0x049f2c3f
0x00000000
0x049f2c00
0x049f2be5
0x049f2be7
0x049f2bec
0x049f2bf4
0x049f2bf6
0x00000000
0x049f2bf6
0x049f2b70
0x049f2b76
0x049f2b2b
0x049f2b2b
0x049f2b2d
0x049f2b2f
0x049f2b32
0x049f2b35
0x049f2b3a
0x00000000
0x049f2b40
0x049f2b43
0x049f2b45
0x049f2b47
0x049f2b4a
0x049f2b4d
0x049f2b53
0x00000000
0x00000000
0x00000000
0x049f2b53
0x049f2b78
0x049f2b78
0x049f2b7b
0x049f2b7e
0x00000000
0x049f2b7e
0x049f2b76
0x049f2ba5
0x049f2ba5
0x049f2ba8
0x049f2bad
0x00000000
0x00000000
0x049f2baf
0x049f2baf
0x049f2bc2
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bccd8fc016d75f55600d171729eec1481b775232cbd58a6ba8f6f7f8f8ff529b
Instruction ID: c21f9b14d6951ec91e9f599863f09a7f9eb85e1b342cbc2b10a0873a32e04948
Opcode Fuzzy Hash: bccd8fc016d75f55600d171729eec1481b775232cbd58a6ba8f6f7f8f8ff529b
Instruction Fuzzy Hash: 8251E276B101158FCB18CF0CC880ABDB7B2FB8970171588AAED569B325E735BE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A8AE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04A8AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E04A8C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E04A8ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E04A8FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E04A8EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E049E7D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E04A81608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E04A91536(0x4ab8ae4, (_t74 -  *0x4ab8b04 >> 0x14) + (_t74 -  *0x4ab8b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L04A8C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E04A8A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E04A6CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E04A8ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x04a8ae44
0x04a8ae4c
0x04a8ae53
0x04a8ae55
0x04a8ae5c
0x04a8ae64
0x04a8ae68
0x04a8ae75
0x04a8ae75
0x04a8ae78
0x04a8ae7a
0x04a8ae7c
0x04a8ae7f
0x04a8aea8
0x04a8aeab
0x04a8aead
0x00000000
0x00000000
0x04a8aeb3
0x04a8aeb8
0x04a8aebb
0x04a8aebd
0x00000000
0x04a8ae81
0x04a8ae88
0x04a8ae8f
0x04a8ae9b
0x04a8ae96
0x04a8ae96
0x04a8ae96
0x04a8aea0
0x04a8aea3
0x04a8aebf
0x04a8aebf
0x04a8aec3
0x04a8aec9
0x04a8af0d
0x04a8af14
0x04a8af3d
0x04a8af3d
0x04a8af41
0x04a8af44
0x04a8af67
0x04a8af67
0x04a8af6a
0x04a8afca
0x04a8afd1
0x00000000
0x04a8afd1
0x04a8af6c
0x04a8af6d
0x04a8af75
0x04a8af7c
0x04a8af7e
0x04a8af80
0x04a8af85
0x04a8af87
0x04a8af99
0x04a8af89
0x04a8af92
0x04a8af92
0x04a8af9e
0x04a8afa1
0x04a8afa3
0x04a8afa9
0x04a8afb0
0x04a8afb2
0x04a8afb4
0x04a8afbc
0x04a8afbc
0x04a8afb4
0x04a8afb0
0x00000000
0x04a8afa1
0x04a8af4f
0x04a8af57
0x04a8af5c
0x04a8af5e
0x00000000
0x00000000
0x04a8af60
0x04a8af64
0x04a8af64
0x00000000
0x04a8af64
0x04a8af1a
0x04a8af25
0x00000000
0x00000000
0x04a8af27
0x04a8af28
0x04a8af33
0x00000000
0x04a8aed0
0x04a8aed0
0x04a8aed2
0x04a8aee1
0x04a8aee4
0x00000000
0x00000000
0x04a8aee6
0x04a8aeec
0x00000000
0x00000000
0x04a8aefb
0x04a8af07
0x04a8afd3
0x04a8afdb
0x04a8afdb
0x00000000
0x04a8af07
0x04a8aed6
0x04a8aed8
0x04a8aedf
0x00000000
0x00000000
0x00000000
0x04a8aedf
0x04a8aec9

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5990a162e807a068537578539f2af3cb0bbe38f067bf631fc754ff9f513b4a4
Instruction ID: 19699b414edf7a8d8e7101eb950222a23929e641293cb0dcef5a6b2dd32fd70c
Opcode Fuzzy Hash: d5990a162e807a068537578539f2af3cb0bbe38f067bf631fc754ff9f513b4a4
Instruction Fuzzy Hash: 6A41F6B17006119BEB2AFB29C884B7BB799EF84724F04861EF856872D1DB34FC01C691

Uniqueness

Uniqueness Score: -1.00%

Function 049EDBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E049EDBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E049CCC50(E049C4510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E049E7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E04A98ED6(_t102, _t98);
						}
						_t76 = _v44;
						E049E2280(_t58, _v44);
						E049EDD82(_v44, _t102, _t98);
						E049EB944(_t102, _v5);
						return E049DFFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x4ab8628; // 0x0
							_v28 = _t67;
							_t68 =  *0x4ab862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x4ab8628; // 0x0
						_t105 = _v28;
						_t80 =  *0x4ab862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x4a8fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x049edbe9
0x049edbf2
0x049edbf7
0x049edbf9
0x049edbfc
0x049edc00
0x049edc03
0x049edc14
0x049edd54
0x049edd54
0x049edd54
0x049edc18
0x049edc1d
0x049edc1d
0x049edc32
0x049edc3b
0x049edc3e
0x049edc46
0x049edd5b
0x049edd62
0x049edd64
0x049edd67
0x049edd69
0x049edd6b
0x049edd6e
0x049edd70
0x049edd73
0x049edd73
0x00000000
0x049edc4c
0x049edc4e
0x04a33ae3
0x04a33ae8
0x04a33aea
0x049edce7
0x049edce9
0x049edcec
0x049edcee
0x049edcf0
0x049edcf3
0x049edcf5
0x04a33af2
0x04a33af5
0x04a33af5
0x049edd06
0x049edd08
0x049edd0b
0x049edd12
0x04a33b08
0x049edd18
0x049edd18
0x049edd18
0x049edd20
0x049edd23
0x04a33b16
0x04a33b16
0x049edd29
0x049edd2d
0x049edd36
0x049edd40
0x049edd51
0x049edd51
0x049edc54
0x049edc59
0x049edc59
0x049edc5e
0x049edc5e
0x049edc63
0x049edc66
0x049edc6b
0x049edc78
0x049edc7b
0x049edc81
0x049edc81
0x049edc83
0x049edc89
0x00000000
0x00000000
0x049edd7b
0x049edd7b
0x049edc8f
0x049edc8f
0x049edc92
0x049edc99
0x049edc9f
0x049edca5
0x049edcaa
0x049edcaa
0x049edcb3
0x049edcb8
0x049edcbb
0x049edcc1
0x049edccf
0x049edcd2
0x049edcd5
0x049edcd7
0x049edcda
0x049edcdc
0x049edcdc
0x049edce2
0x049edce4
0x00000000
0x049edce4

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d70e1819be8dcd857a378063add1fa544f976e3d7cd55bacfcec1ab21c958d
Instruction ID: cc09be563b8af85b43efa91e2a1239bcbc1ac36c7724b76a3db64e12fd0f5891
Opcode Fuzzy Hash: b2d70e1819be8dcd857a378063add1fa544f976e3d7cd55bacfcec1ab21c958d
Instruction Fuzzy Hash: 6251B171A01206DFCB15CF69C4906AEFBF5FB48350F20866AD955A7340EB35F984CB90

Uniqueness

Uniqueness Score: -1.00%

Function 049DEF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E049DEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E049C9080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77dfc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E049C2D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x049def4b
0x049def4d
0x049def57
0x049df0bd
0x049df0c2
0x049df0d2
0x049df0d2
0x049df0c2
0x049def5d
0x049def5f
0x049def67
0x049def6a
0x049def6d
0x049def74
0x049def7f
0x049def82
0x049def82
0x049def86
0x049def88
0x049def8c
0x049def8f
0x049def8f
0x049def8f
0x00000000
0x049def91
0x049def93
0x049defc4
0x049defc4
0x049defc4
0x049defca
0x049defd0
0x049df0a6
0x00000000
0x00000000
0x049df0af
0x04a2bb06
0x04a2bb0a
0x049df0b5
0x049df0b5
0x049df0b5
0x049df0b5
0x00000000
0x049defd6
0x049defd9
0x049df0de
0x049df0e2
0x049defdf
0x049defdf
0x049defdf
0x049defe5
0x04a2bafc
0x04a2bafc
0x049defe5
0x049defeb
0x049defed
0x049df00f
0x049df011
0x049df01a
0x049df01d
0x049df021
0x049df028
0x049df029
0x049df029
0x049df02c
0x00000000
0x049df02c
0x049deff3
0x049deff9
0x049df0ea
0x049df0ed
0x049df0ef
0x00000000
0x049df0ef
0x049df003
0x04a2bb12
0x049df045
0x049df049
0x049df051
0x049df09e
0x049df0a0
0x049df0a0
0x049df09e
0x049df053
0x049df064
0x049df064
0x049df06b
0x04a2bb1a
0x04a2bb1a
0x049df071
0x049df071
0x049df07d
0x049df082
0x049df08f
0x049df08f
0x049df009
0x049df00d
0x00000000
0x049df00d
0x049defd0
0x049def97
0x049defa5
0x049defaa
0x00000000
0x049defac
0x049defac
0x049defac
0x00000000
0x049defb2
0x049df036
0x049df03a
0x049df040
0x049df090
0x00000000
0x049df092
0x049df042
0x00000000
0x049df042
0x049defb7
0x049defb9
0x049defbc
0x049defb0
0x049defb0
0x00000000
0x049defbe
0x049defbe
0x049defc1
0x00000000
0x049defc1
0x049defbc
0x049defaa
0x049def91

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 527009240d0d4083eb2fc6b22538e76cdf0a4aaee0905946ccbc15ad83df2b11
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 0F51FF30A04649EFDF28CF68C1C17AEBBB6AF05314F18C1B8D5469B281D376B989D791

Uniqueness

Uniqueness Score: -1.00%

Function 04A9740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E04A9740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E04A1D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E04A0F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L049E4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L049E4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E04A0F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L049E4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x04a9740d
0x04a9740d
0x04a97412
0x04a97413
0x04a97416
0x04a97418
0x04a9741c
0x04a9741f
0x04a97422
0x04a97422
0x04a97428
0x04a9742a
0x04a9742a
0x04a97451
0x04a97432
0x04a9744f
0x04a9744f
0x00000000
0x04a97434
0x04a97438
0x04a97443
0x04a97517
0x04a97517
0x04a9751a
0x04a97535
0x04a97520
0x04a97527
0x04a9752c
0x04a97531
0x04a97533
0x00000000
0x04a97533
0x00000000
0x04a97531
0x04a9754b
0x04a9754f
0x04a9755c
0x04a9755c
0x04a9755f
0x04a97560
0x04a97561
0x04a97562
0x04a97563
0x04a97568
0x04a9756a
0x04a9756c
0x04a9756d
0x04a9756d
0x04a9756f
0x04a97572
0x04a97574
0x04a97577
0x04a9757c
0x04a9757f
0x00000000
0x04a97551
0x04a97551
0x04a97551
0x04a97553
0x04a97553
0x04a97449
0x04a97449
0x04a9744c
0x04a9744c
0x00000000
0x04a9744c
0x04a97443
0x04a9750e
0x04a97514
0x04a97514
0x04a97455
0x04a97469
0x04a9746d
0x00000000
0x04a97473
0x04a97473
0x04a97476
0x04a97480
0x04a97484
0x04a9748e
0x04a97493
0x04a97493
0x04a97496
0x04a97499
0x04a974a1
0x04a974b1
0x04a974b5
0x00000000
0x04a974bb
0x04a974c1
0x04a974c1
0x04a974c4
0x04a974c5
0x04a974c6
0x04a974c7
0x04a974c8
0x04a974cd
0x00000000
0x04a974d3
0x04a974d3
0x04a974d6
0x04a974d8
0x04a974db
0x04a974dd
0x04a974e0
0x04a974e7
0x04a974ee
0x04a974ee
0x04a974f4
0x04a974f9
0x00000000
0x04a974fb
0x04a974fb
0x04a974fd
0x04a97500
0x04a97503
0x04a97505
0x04a97505
0x04a974f9
0x00000000
0x04a974cd
0x04a974b5
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: dea58a16843c2a44b0c63375e77c2719b8baaa6ccbb3305c8e6b52a51a33d783
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: FC517A75600606EFDF56CF14C580A96BBF5FF49704F14C0AAE9089F262E771E946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 049F2990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E049F2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x4a9ff00);
				E04A1D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x49a1664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E04A0E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x49a1668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E04A451BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x49a166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E049F2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E049D6600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E049F2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E049DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E049F2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E049F2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E049F2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E04A1D0D1(_t62);
				goto L28;
			}

0x049f2990
0x049f2992
0x049f2997
0x049f29a3
0x049f29a6
0x049f29ab
0x049f29ad
0x049f29b2
0x04a35c80
0x049f29b8
0x049f29b8
0x049f29bb
0x049f29c0
0x049f29c5
0x049f29c6
0x049f29c6
0x049f29cb
0x00000000
0x00000000
0x049f29cd
0x049f29d0
0x049f29d9
0x049f29db
0x049f29dd
0x049f2a7f
0x049f2a84
0x049f2a87
0x049f2a89
0x04a35ca1
0x04a35ca3
0x00000000
0x049f2a8f
0x049f2a8f
0x00000000
0x049f2a8f
0x00000000
0x049f29e3
0x049f29e3
0x049f29e3
0x00000000
0x049f29e3
0x049f29dd
0x00000000
0x049f29db
0x049f29e6
0x049f29e9
0x049f29eb
0x049f29ed
0x049f29f3
0x049f29f5
0x049f29f8
0x049f29fa
0x049f2a97
0x049f2a9a
0x049f2a9d
0x049f2add
0x00000000
0x049f2a9f
0x049f2aa2
0x049f2aa5
0x049f2aa8
0x049f2aab
0x04a35cab
0x04a35caf
0x04a35cc5
0x04a35cda
0x04a35cdc
0x04a35cdf
0x04a35ce5
0x00000000
0x04a35ceb
0x04a35ced
0x04a35cee
0x00000000
0x04a35cee
0x04a35cb1
0x04a35cb4
0x04a35cb9
0x04a35cbb
0x00000000
0x04a35cbd
0x04a35cbd
0x00000000
0x04a35cbd
0x04a35cbb
0x049f2ab1
0x049f2ab1
0x049f2ac4
0x049f2ac6
0x049f2ac6
0x00000000
0x049f2ac6
0x049f2aab
0x00000000
0x049f2a00
0x049f2a09
0x049f2a0e
0x049f2a21
0x049f2a24
0x049f2a35
0x049f2a3a
0x049f2a3d
0x049f2a42
0x049f2a59
0x049f2a59
0x049f2a5c
0x049f2a5f
0x049f2a5f
0x049f29fa
0x049f29f3
0x049f2a64
0x049f2a64
0x049f2a6b
0x049f2a6b
0x049f2a6d
0x049f2a72
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6307b1aaca0a818a1de60f4942a9f476c188e5750a248685671c3548f06a2440
Instruction ID: 15264bce29be88753b8406dcd212ee0564349fcc5a0ca0a9b6cbc079014cd41a
Opcode Fuzzy Hash: 6307b1aaca0a818a1de60f4942a9f476c188e5750a248685671c3548f06a2440
Instruction Fuzzy Hash: 10515B71A00219EFDF25DF55CD40ADEBBB6BF48318F1480A5E914AB250D336ED52DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 049F4D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E049F4D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x4abd360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E04A0FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4ab7bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E04A0B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L049E4620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E049CCCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E04A0B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E04A0F380(_t67 + 0xc, 0x49a5138, 0x10) == 0) {
								 *0x4ab60d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E049F4F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E049F4E70(0x4ab86b0, 0x49f5690, 0, 0) != 0) {
					_t46 = E049CCCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x049f4d3b
0x049f4d4d
0x049f4d53
0x049f4d58
0x049f4d65
0x049f4d6c
0x049f4d71
0x049f4d77
0x049f4d7f
0x049f4d8c
0x049f4d8e
0x049f4dad
0x049f4db0
0x049f4db7
0x049f4db8
0x049f4db9
0x049f4dba
0x049f4dbb
0x049f4dc1
0x049f4dc8
0x049f4dcc
0x049f4dd5
0x049f4dde
0x049f4ddf
0x049f4de0
0x049f4de1
0x049f4de6
0x049f4de7
0x049f4de9
0x049f4df3
0x00000000
0x00000000
0x04a36c7c
0x04a36c8a
0x04a36c8a
0x04a36c9d
0x04a36ca7
0x04a36cac
0x04a36cb2
0x04a36cb9
0x00000000
0x04a36cbf
0x04a36cbf
0x00000000
0x04a36cbf
0x04a36cb9
0x049f4dfb
0x04a36ccf
0x04a36cd3
0x049f4e32
0x049f4e39
0x04a36ce0
0x04a36cf2
0x04a36cf2
0x04a36ce0
0x049f4e3f
0x049f4e41
0x049f4e51
0x049f4e51
0x049f4e03
0x049f4e03
0x049f4e09
0x049f4e0f
0x049f4e57
0x00000000
0x00000000
0x049f4e1b
0x049f4e30
0x049f4e5b
0x049f4e5b
0x00000000
0x049f4e30
0x049f4e11
0x049f4e11
0x049f4e16
0x00000000
0x049f4e16
0x049f4e01
0x00000000
0x049f4e01
0x049f4da5
0x04a36c6b
0x00000000
0x049f4dab
0x049f4dab
0x00000000
0x049f4dab

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bf99dcd5279c85c835dbe3373af3b5b9cd9e004226c035438382e9429ac265
Instruction ID: 0cfb89b374567457a79578a4ccfc4ba7bd5476c5abe6f4db8547af68ddf3f34e
Opcode Fuzzy Hash: a7bf99dcd5279c85c835dbe3373af3b5b9cd9e004226c035438382e9429ac265
Instruction Fuzzy Hash: C241C371A40318AFEB31DF14CD84FA7B7AAEB54714F0044A9EA4597281E774FD44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 049F4BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E049F4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x4abd360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E049CCC50(_t86);
					L11:
					return E04A0B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x4ab8504
				E049E2280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E04A0FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E04A0B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L049E4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E049CCCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x4ab8504
								E049DFFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E049F4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x049f4bad
0x049f4bbf
0x049f4bc2
0x049f4bc6
0x049f4bcd
0x049f4bd9
0x04a367fe
0x04a36800
0x049f4ccc
0x049f4ccd
0x049f4cb7
0x049f4cc9
0x049f4cc9
0x049f4bdf
0x049f4be5
0x00000000
0x00000000
0x049f4beb
0x049f4bef
0x00000000
0x00000000
0x049f4bf5
0x049f4bf9
0x049f4c06
0x049f4c0b
0x049f4c17
0x049f4c1c
0x049f4c1f
0x049f4c25
0x049f4c33
0x049f4c3d
0x049f4c40
0x049f4c43
0x049f4c47
0x049f4c4d
0x049f4c53
0x049f4c54
0x049f4c55
0x049f4c56
0x049f4c5b
0x049f4c5c
0x049f4c63
0x049f4c6b
0x00000000
0x00000000
0x04a36776
0x04a36784
0x04a36784
0x04a3679f
0x04a367a7
0x04a367af
0x04a367ce
0x00000000
0x04a367b1
0x04a367b7
0x04a367b8
0x04a367c1
0x04a367d3
0x04a367d9
0x04a367dd
0x049f4c94
0x049f4c94
0x049f4c98
0x049f4c9c
0x049f4ca3
0x04a367f4
0x04a367f4
0x049f4cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x049f4cb5
0x049f4c79
0x049f4c7e
0x049f4c89
0x049f4c8b
0x049f4c8f
0x049f4c8f
0x00000000
0x049f4c89
0x04a367c3
0x00000000
0x04a367c3
0x04a367af
0x049f4c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22993d2a3ea891f7423e685c054c3f90cb84a0676715ad23b87735bae4d7a42
Instruction ID: 1541990e30d8fc6436cb66f0f2b80262766c83c295890bb82470b6d2759b513e
Opcode Fuzzy Hash: d22993d2a3ea891f7423e685c054c3f90cb84a0676715ad23b87735bae4d7a42
Instruction Fuzzy Hash: E641A375A40228ABDB31DF64CD40BEA77B8EF45700F4145B5EA08AB241EB74FE84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 049D8A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E049D8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x4abd360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E04A0B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E049DE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x49a1180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E049F1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E04A03C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E049D8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x049d8a0a
0x049d8a1c
0x049d8a23
0x049d8a2e
0x049d8a30
0x049d8a36
0x049d8a3c
0x049d8a3e
0x049d8a4a
0x049d8a52
0x049d8a9c
0x049d8aae
0x049d8a58
0x049d8a5e
0x049d8a6a
0x049d8a6f
0x049d8a75
0x049d8a7d
0x049d8a85
0x049d8a86
0x049d8a89
0x049d8a93
0x049d8a99
0x049d8a9b
0x00000000
0x049d8aaf
0x049d8abe
0x049d8ac3
0x049d8acb
0x049d8ad7
0x049d8ae0
0x049d8af1
0x00000000
0x049d8af1
0x049d8acd
0x049d8ad5
0x049d8afb
0x049d8afd
0x049d8aff
0x049d8b07
0x049d8b22
0x049d8b24
0x049d8b2a
0x049d8b2e
0x049d8b3f
0x049d8b78
0x049d8b41
0x049d8b52
0x049d8b54
0x049d8b5c
0x049d8b74
0x049d8b74
0x049d8b5c
0x049d8b3f
0x049d8b5e
0x049d8b61
0x049d8b64
0x049d8b64
0x049d8b6c
0x049d8b6c
0x049d8b11
0x04a29cd5
0x04a29cd5
0x049d8b17
0x049d8b1a
0x049d8b1a
0x00000000
0x049d8ad5
0x049d8a89

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a168e96a61b0062cba9b065790d3aef31259d1a1c323db7ae8921d2d717ac40
Instruction ID: 3a46ec0622cd60d27cc8040ba32df75b38b3a675efd7df2dda47817820aab3c6
Opcode Fuzzy Hash: 8a168e96a61b0062cba9b065790d3aef31259d1a1c323db7ae8921d2d717ac40
Instruction Fuzzy Hash: 314153B4A003289FDB24EF55DC88AA9B7B9EF54300F1085F9D81997252E774AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04A8AA16, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E04A8ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E04A8AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E04A8AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E04A6CB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L049E77F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E049E7D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E04A8131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E04A6CB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x04a8aa1f
0x04a8aa21
0x04a8aa23
0x04a8aa2b
0x04a8aa30
0x04a8aa36
0x04a8aa39
0x04a8aa42
0x04a8aa75
0x04a8aa7a
0x04a8aa7c
0x04a8aa7c
0x04a8aa88
0x04a8aa8a
0x04a8aa8f
0x04a8ab02
0x04a8ab04
0x04a8aa99
0x04a8aaa8
0x04a8aaaf
0x04a8aab3
0x04a8aacc
0x04a8aad1
0x04a8aad6
0x04a8aae0
0x04a8aaf3
0x04a8aaf9
0x04a8aafe
0x04a8aafe
0x04a8aaf3
0x04a8aad6
0x04a8aab3
0x04a8ab07
0x04a8ab0a
0x04a8ab11
0x04a8ab23
0x04a8ab13
0x04a8ab1c
0x04a8ab1c
0x04a8ab2b
0x04a8ab44
0x04a8ab44
0x04a8ab51
0x04a8ab51
0x04a8aa44
0x04a8aa47
0x04a8aa4c
0x00000000
0x00000000
0x04a8aa5a
0x04a8aa64
0x04a8aa72
0x00000000
0x04a8aa66
0x04a8aa66
0x04a8aa68
0x04a8aa6a
0x00000000
0x04a8aa6a

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: c21c63276398084af20d00cd1f9422d9c87a23e0c8fb82c593bd890d11eddfdb
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 4231E232F006046BEB15ABA9C949BBFF7BAEFD4310F05806EE845A7291DA74ED40C650

Uniqueness

Uniqueness Score: -1.00%

Function 04A8FDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04A8FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E04A8FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E04A90A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E049E7D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E04A81608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E04A92B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E04A8C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E04A8DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E049E7D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E04A8A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x04a8fde7
0x04a8fde8
0x04a8fdec
0x04a8fdee
0x04a8fdf5
0x04a8fdf7
0x04a8fdfc
0x04a8fe19
0x04a8fe22
0x04a8fe26
0x04a8fec6
0x04a8fecd
0x04a8fed5
0x04a8fee7
0x04a8fed7
0x04a8fee0
0x04a8fee0
0x04a8feef
0x04a8ff00
0x04a8ff02
0x04a8ff07
0x04a8ff07
0x00000000
0x04a8feef
0x04a8fe33
0x04a8fe55
0x04a8fe59
0x04a8fe5b
0x04a8fe5e
0x04a8fe69
0x04a8fe6d
0x04a8fe6d
0x04a8fe69
0x04a8fe35
0x04a8fe41
0x04a8fe41
0x04a8fe79
0x04a8fe8b
0x04a8fe7b
0x04a8fe84
0x04a8fe84
0x04a8fe93
0x00000000
0x04a8fea8
0x04a8feba
0x00000000
0x04a8feba
0x04a8fdfe
0x04a8fe01
0x04a8fe02
0x04a8fe08
0x04a8ff0c
0x04a8ff14
0x04a8ff14

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: b5ac84683a357f7739c702c60a4ff70230753a4d4b03eac94c9aa03cfaad95e0
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: C831E332700645AFE722AB68C944F6ABBE9EBC5650F18446DF446CB782DB74FC41C720

Uniqueness

Uniqueness Score: -1.00%

Function 04A8EA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E04A8EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E049E2280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E04A8E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E049CF900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E049DFFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E04A8AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E04A8BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E049E7D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E04A7FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E049DFFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E04A8A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x04a8ea55
0x04a8ea66
0x04a8ea68
0x04a8ea6c
0x04a8ea6f
0x04a8ea72
0x04a8ea75
0x04a8ea7a
0x04a8ea7a
0x04a8ea7e
0x04a8ea80
0x04a8ea85
0x04a8ea8b
0x04a8eab5
0x04a8eabc
0x04a8eabf
0x04a8eabf
0x04a8eaca
0x04a8eace
0x04a8ead0
0x04a8eae4
0x04a8eaeb
0x04a8eaf0
0x04a8eaf5
0x04a8eb09
0x04a8eb0d
0x04a8eb1d
0x04a8eb2d
0x04a8eb38
0x04a8eb3d
0x04a8eb41
0x04a8eb4a
0x04a8eb60
0x04a8eb4c
0x04a8eb52
0x04a8eb59
0x04a8eb59
0x04a8eb68
0x04a8eb71
0x04a8eb71
0x04a8ea8d
0x04a8ea8f
0x04a8ea92
0x04a8ea97
0x04a8ea97
0x04a8ea9b
0x04a8ea9c
0x04a8ea9e
0x04a8eaa6
0x04a8eaa6
0x04a8eb7e

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: bbb1217e51a11d99ee90114e8e4450253e5f6afdad7c969db12906fb5b35bf0d
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 4731C172604705ABD719EF24CC84A6BB7AAFBC4714F04892DF55287644EB30F805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A469A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E04A469A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x4abd360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L049D6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E04A46BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E04A09980() >= 0) {
							E049E2280(_t56, 0x4ab8778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4ab8774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4ab8774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E049CB6F0(0x49ac338, 0x49ac288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E04A09520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E04A095D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E049DFFB0(_t68, _t77, 0x4ab8778);
				}
				_pop(_t78);
				return E04A0B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x04a469b5
0x04a469be
0x04a469c3
0x04a469c9
0x04a469cc
0x04a469d1
0x04a469d3
0x04a469de
0x04a469e1
0x04a469ea
0x04a469f6
0x04a469fe
0x04a46a13
0x04a46a14
0x04a46a15
0x04a46a16
0x04a46a1e
0x04a46a26
0x04a46a31
0x04a46a36
0x04a46a37
0x04a46a40
0x04a46a49
0x04a46a4a
0x04a46a53
0x04a46a59
0x04a46a5d
0x04a46a5e
0x04a46a64
0x04a46a67
0x04a46a6a
0x04a46a6d
0x04a46a70
0x04a46a77
0x04a46a7d
0x04a46a86
0x04a46a89
0x04a46a9c
0x04a46a9f
0x04a46aa2
0x04a46aa5
0x04a46aaf
0x04a46ab1
0x04a46ab8
0x04a46ab9
0x04a46abb
0x04a46abe
0x04a46ac5
0x04a46ac5
0x04a46aaf
0x04a46a40
0x04a46a26
0x04a469fe
0x04a46ace
0x04a46ad0
0x04a46ad3
0x04a46ad8
0x04a46adf
0x04a46adf
0x04a46ae8
0x04a46aef
0x04a46aef
0x04a46af9
0x04a46b06

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a15642ab6c41cddcab98a9ee34de01801b6104e844491fac78d1e5dc9f7d54
Instruction ID: 3cf8075cb13df7729422b1b9b2930ee53ae5d2b660f45d6d4b7966ea2d1231d6
Opcode Fuzzy Hash: e9a15642ab6c41cddcab98a9ee34de01801b6104e844491fac78d1e5dc9f7d54
Instruction Fuzzy Hash: 074182B1D00608AFDB14DFA5D940BFEBBF8FF89718F148129E914A7291DB74A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 049C5210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E049C5210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E049C52A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E04A095D0();
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E049DEB70(_t54, 0x4ab79a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E04A095D0();
								L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E049DEB70(_t54, 0x4ab79a0);
						}
						return _t52;
					}
					L5:
					_t33 = E04A0F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E049DEB70(_t54, 0x4ab79a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E04A095D0();
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x049c5220
0x049c5224
0x04a20d13
0x04a20d16
0x04a20d19
0x049c522a
0x049c522a
0x049c522d
0x049c522d
0x049c5231
0x049c5235
0x049c5239
0x04a20d5c
0x04a20d62
0x00000000
0x00000000
0x04a20d6a
0x04a20d7b
0x04a20d7f
0x04a20d81
0x04a20d84
0x04a20d95
0x04a20d95
0x04a20d6c
0x04a20d71
0x04a20d71
0x04a20d9a
0x00000000
0x049c524a
0x049c524a
0x049c5250
0x04a20d24
0x04a20d35
0x04a20d39
0x04a20d3b
0x04a20d3e
0x04a20d50
0x04a20d50
0x04a20d26
0x04a20d2b
0x04a20d2b
0x00000000
0x04a20d55
0x049c5256
0x049c525b
0x049c5265
0x04a20da7
0x049c526b
0x049c526e
0x049c5272
0x04a20db1
0x04a20db4
0x04a20dc5
0x04a20dc5
0x049c5272
0x049c5278
0x049c527e
0x049c528a
0x049c528c
0x049c528d
0x00000000
0x049c5280
0x049c5282
0x049c5288
0x049c529f
0x049c5292
0x00000000
0x049c5292
0x00000000
0x049c5288
0x049c527e

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0eca171594c3ef83e09fbf3b4c403715da7803cd4d778b5c3acdf863f59f9dc
Instruction ID: 053c8683d4869a38d06a7c4c5fa5559fc2159227a163c92d0f52f2afbea83147
Opcode Fuzzy Hash: b0eca171594c3ef83e09fbf3b4c403715da7803cd4d778b5c3acdf863f59f9dc
Instruction Fuzzy Hash: 4B314631246620EFD736AF18CA80F7677A9FF40770F118A29E5594B1E1EB70F800DA91

Uniqueness

Uniqueness Score: -1.00%

Function 04A03D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A03D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E049D7B60(0, _t61, 0x49a11c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E049D7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L049E4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x04a03d4c
0x04a03d50
0x04a03d55
0x04a03d5e
0x04a3e79a
0x00000000
0x04a3e79a
0x04a03d68
0x04a3e789
0x04a03d9d
0x04a03da3
0x04a03daf
0x04a03db5
0x04a03dbc
0x04a03dc4
0x04a03dc9
0x04a03dce
0x04a3e7ae
0x04a3e7ae
0x04a03dde
0x04a03de2
0x04a03de7
0x04a03e0d
0x04a03e13
0x04a03e16
0x04a03e1e
0x04a03e25
0x04a03e28
0x00000000
0x00000000
0x04a03e2a
0x04a03e2f
0x04a03e37
0x04a03e37
0x00000000
0x04a03e37
0x04a03e31
0x00000000
0x04a03e31
0x04a03e20
0x04a03e20
0x04a03e35
0x00000000
0x04a03de9
0x04a03de9
0x04a03de9
0x04a03dee
0x04a03dfd
0x04a03dff
0x04a03e02
0x04a03e05
0x04a03e05
0x00000000
0x04a03df0
0x04a03de7
0x04a3e78f
0x04a3e794
0x04a03d79
0x04a03d84
0x04a03d89
0x04a03d8e
0x00000000
0x04a3e7a4
0x04a03d96
0x04a03d9a
0x00000000
0x04a03d9a
0x00000000
0x04a3e794
0x04a03d6e
0x04a03d73
0x00000000
0x04a3e7b5
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe4b57c141da78ae6e039c2e4ca3f094930f58603adab5e2bf4d4b06df69fb9
Instruction ID: 688f5bd3949005aff7233a70a6ba990b0b1e89cb14cd37c74127ff59ea4a2971
Opcode Fuzzy Hash: cfe4b57c141da78ae6e039c2e4ca3f094930f58603adab5e2bf4d4b06df69fb9
Instruction Fuzzy Hash: DA319C71B00615DFCB248F2AE841A6BBBF5EF95700B05C86AE849CB390F730E850D790

Uniqueness

Uniqueness Score: -1.00%

Function 049FA61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E049FA61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x4aa0220);
				E04A1D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4ab7b9c; // 0x0
				_t55 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E04A1D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4ab7b10 =  *0x4ab7b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x4ab536c; // 0x2dc7a30
					if( *_t51 != 0x4ab5368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4ab5368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x4ab536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E049FA70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x049fa61c
0x049fa61e
0x049fa623
0x049fa628
0x049fa62b
0x049fa62d
0x049fa648
0x049fa64a
0x049fa64f
0x04a39b44
0x049fa6ec
0x049fa6f1
0x049fa6f1
0x049fa655
0x049fa657
0x049fa65a
0x049fa65d
0x049fa662
0x049fa663
0x049fa667
0x049fa668
0x049fa66d
0x049fa706
0x049fa706
0x04a39bda
0x04a39be6
0x04a39beb
0x00000000
0x04a39beb
0x049fa679
0x04a39b7a
0x00000000
0x04a39b7a
0x049fa683
0x049fa6f4
0x049fa6f7
0x049fa6f9
0x049fa6fd
0x049fa6a0
0x049fa6a0
0x049fa6ad
0x049fa6af
0x049fa6b4
0x04a39ba7
0x04a39bac
0x00000000
0x00000000
0x04a39bc6
0x04a39bce
0x04a39bd1
0x04a39bd3
0x04a39bd3
0x00000000
0x04a39bd1
0x049fa6bd
0x049fa6c3
0x049fa6c6
0x049fa6d2
0x049fa701
0x049fa704
0x00000000
0x049fa704
0x049fa6d4
0x049fa6d6
0x049fa6d9
0x049fa6db
0x049fa6e1
0x049fa6e6
0x049fa6e8
0x049fa6e8
0x049fa6ea
0x00000000
0x049fa6ea
0x049fa688
0x049fa692
0x049fa694
0x049fa699
0x00000000
0x00000000
0x049fa69d
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39dba1835578bd6ea56d6f468f4a18f040e813df402760e0a20875d3055e89e0
Instruction ID: 75ef2af6cf89105e1eae6d9a3dd77afd0c569c9208129a0f7b5be05a30a16de6
Opcode Fuzzy Hash: 39dba1835578bd6ea56d6f468f4a18f040e813df402760e0a20875d3055e89e0
Instruction Fuzzy Hash: 674169B5A00205DFDB15CF58C890B9ABBF5FF99304F1480A9E909AB355D774B901CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04A47016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04A47016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x4abd360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E04A46B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E04A46B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E049E7D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E04A09AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E04A0B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L049E4620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x04a47016
0x04a4701e
0x04a4702b
0x04a47033
0x04a47037
0x04a4703c
0x04a4703e
0x04a47041
0x04a47045
0x04a4704a
0x04a47050
0x04a47055
0x04a4705a
0x04a47062
0x04a47062
0x04a4705a
0x04a47064
0x04a47064
0x04a47067
0x04a47071
0x04a47096
0x04a4709b
0x04a470a2
0x04a470a6
0x04a470a7
0x04a470ad
0x04a470b3
0x04a470b6
0x04a470bb
0x04a470c3
0x04a470c3
0x04a470c6
0x04a470cd
0x04a470dd
0x04a470e0
0x04a470e2
0x04a470e2
0x04a470ee
0x04a47101
0x04a470f0
0x04a470f9
0x04a470f9
0x04a4710a
0x04a4710e
0x04a47112
0x04a47117
0x04a47118
0x04a47118
0x04a470bb
0x04a4711d
0x04a47123
0x04a47131
0x04a47131
0x04a47136
0x04a4713d
0x04a4713e
0x04a4713f
0x04a4714a
0x04a4714a
0x04a47084
0x04a47088
0x00000000
0x04a4708e
0x04a4708e
0x04a47092
0x00000000
0x04a47092

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3024de1b3cc4d2155e140e6556b59b95fe5b7bf3057896fc944b8c7892a8957
Instruction ID: 27d6b3a5895c1084805dc950d6d969d35fdc7bd061a78591b3d0ae93f8badc80
Opcode Fuzzy Hash: e3024de1b3cc4d2155e140e6556b59b95fe5b7bf3057896fc944b8c7892a8957
Instruction Fuzzy Hash: 7031C0766057919BD321DF68C940A6EB3E9FFC8700F044A29F89587690E730F904CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 049EC182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E049EC182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E049E7D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E04A98D34(_v8, _t80);
					}
					E049E2280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E049DFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E04A98833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E049DFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E04A0B180();
						if(_a4 != 0) {
							E049E2280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E049EBB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E049EBB2D(_t16, _t15);
						E049EB944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E049DFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E049DFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E049DFFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x049ec18d
0x049ec18f
0x049ec191
0x049ec19b
0x049ec1a0
0x049ec1d4
0x049ec1de
0x04a32d6e
0x049ec1e4
0x049ec1e4
0x049ec1e4
0x049ec1ec
0x04a32d7d
0x04a32d7d
0x049ec1f3
0x049ec1ff
0x04a32d88
0x04a32d8d
0x04a32d94
0x04a32d94
0x04a32d9f
0x04a32da4
0x04a32dab
0x04a32db0
0x04a32db2
0x04a32db3
0x04a32db4
0x04a32dbc
0x04a32dc3
0x04a32dc3
0x049ec205
0x049ec205
0x049ec208
0x049ec20e
0x049ec211
0x049ec216
0x049ec219
0x049ec21f
0x049ec222
0x049ec22c
0x049ec234
0x049ec23a
0x049ec23f
0x049ec245
0x049ec24b
0x049ec251
0x049ec25a
0x049ec276
0x049ec27d
0x049ec27d
0x049ec25c
0x049ec25c
0x00000000
0x049ec25e
0x049ec1a4
0x049ec1aa
0x049ec1b3
0x049ec265
0x049ec26c
0x049ec26c
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: d528b6e62cbae978c43ddfc958264c7136f2884dc1dff154dfe6f6b5046b6289
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 1F314872701546BEE70AEBB5C480BF9FB98BF82308F08817AD41847341DB35BA05D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A73D40, Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E04A73D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x4abd360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E049E2280(_t34, 0x4ab8a6c);
				_t64 =  *0x4ab5768; // 0x77f05768
				if(_t64 != 0x4ab5768) {
					while(1) {
						_t8 = _t64 + 8; // 0x77f05770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E049DFFB0(_t53, _t64, 0x4ab8a6c);
						 *0x4abb1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E049E2280(_t45, 0x4ab8a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x4ab5768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E049DFFB0(_t51, _t64, 0x4ab8a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E04A0B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x04a73d40
0x04a73d48
0x04a73d52
0x04a73d59
0x04a73d5d
0x04a73d61
0x04a73d63
0x04a73d67
0x04a73d69
0x04a73d72
0x04a73d76
0x04a73d7a
0x04a73d7f
0x04a73d8b
0x04a73d91
0x04a73d91
0x04a73d91
0x04a73d94
0x04a73d96
0x04a73d9d
0x04a73da1
0x04a73db0
0x04a73dba
0x04a73dbc
0x04a73dbc
0x04a73dc6
0x04a73dcb
0x04a73dcf
0x04a73dd1
0x04a73dd4
0x00000000
0x00000000
0x04a73dd9
0x04a73e0c
0x04a73e0c
0x04a73e0f
0x04a73ddb
0x04a73ddb
0x04a73de0
0x00000000
0x04a73de2
0x04a73de2
0x04a73de4
0x04a73de8
0x04a73deb
0x04a73df1
0x00000000
0x04a73df3
0x04a73df3
0x04a73df5
0x04a73df8
0x04a73dfa
0x00000000
0x04a73dfa
0x04a73df1
0x04a73de0
0x04a73e11
0x04a73e11
0x00000000
0x04a73dfe
0x04a73e04
0x04a73e06
0x00000000
0x04a73e06
0x00000000
0x04a73e04
0x04a73d91
0x04a73e15
0x04a73e1a
0x04a73e1f
0x04a73e1f
0x04a73e23
0x04a73e29
0x00000000
0x00000000
0x04a73e2e
0x00000000
0x04a73e30
0x04a73e30
0x04a73e35
0x00000000
0x04a73e37
0x04a73e3e
0x04a73e42
0x04a73e48
0x04a73e4e
0x00000000
0x04a73e4e
0x04a73e35
0x00000000
0x04a73e2e
0x04a73e5b
0x04a73e5c
0x04a73e5d
0x04a73e68
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0576a0ce8228ae9f06d0bbe16a3951682e860a46c2a1ea2dcba3d8fdb4a7f52
Instruction ID: f07062bce76f952bf3995d2aeb2c39100a9119c69a53d6ae032623f44f77217c
Opcode Fuzzy Hash: a0576a0ce8228ae9f06d0bbe16a3951682e860a46c2a1ea2dcba3d8fdb4a7f52
Instruction Fuzzy Hash: 7B3178B1A09302DFCB24DF18D98045ABBE5FF85704F46896EE8888B252D330E944CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 049FA70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E049FA70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4ab7b10; // 0x8
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4ab7b10 = 8;
					 *0x4ab7b14 = 0x4ab7b0c;
					 *0x4ab7b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x9
					E049FA990(0x4ab7b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L049FA840(__edx, __ecx, __ecx, _t52, 0x4ab7b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4ab7b10; // 0x8
					_t3 = _t37 + 0x27; // 0x2f
					__eflags = _t3 >> 5 -  *0x4ab7b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4ab7b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x2f
						_v8 = _t4 >> 5;
						_t50 = L049E4620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4ab7b18 = _v8;
						_t8 = _t52 + 7; // 0xf
						E04A0F3E0(_t50,  *0x4ab7b14, _t8 >> 3);
						_t28 =  *0x4ab7b14; // 0x77f07b0c
						__eflags = _t28 - 0x4ab7b0c;
						if(_t28 != 0x4ab7b0c) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x10
						 *0x4ab7b14 = _t50;
						_t48 = _v12;
						 *0x4ab7b10 = _t9;
						goto L6;
					}
					 *0x4ab7b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x049fa713
0x049fa714
0x049fa717
0x049fa71d
0x049fa720
0x049fa722
0x049fa727
0x049fa74a
0x049fa754
0x049fa75e
0x049fa768
0x049fa76a
0x049fa773
0x049fa78b
0x049fa790
0x049fa792
0x049fa741
0x049fa741
0x049fa743
0x049fa749
0x049fa749
0x049fa732
0x049fa73a
0x049fa797
0x049fa79d
0x049fa7a3
0x049fa7a9
0x049fa7b6
0x049fa7bc
0x049fa7ca
0x049fa7e0
0x049fa7e2
0x049fa7e4
0x04a39bf2
0x00000000
0x04a39bf2
0x049fa7ed
0x049fa7f2
0x049fa800
0x049fa805
0x049fa80d
0x049fa812
0x04a39c08
0x04a39c08
0x049fa818
0x049fa81b
0x049fa821
0x049fa824
0x00000000
0x049fa824
0x049fa7ae
0x00000000
0x049fa7ae
0x049fa73c
0x049fa73e
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1457560a893fbeaa34843a3007838aaebafc624480f4c8de69e01a81cb38344
Instruction ID: d967a505d22ba3cc903776d6d16855d61a0d7c698fa35c00a003f9504aaa1fa1
Opcode Fuzzy Hash: d1457560a893fbeaa34843a3007838aaebafc624480f4c8de69e01a81cb38344
Instruction Fuzzy Hash: 0A319CB96206009BD715CB08DC81F6A77B9EBE4710F14496AE10A97661E2B4AD02DFD1

Uniqueness

Uniqueness Score: -1.00%

Function 049F61A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E049F61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E049F5E50(0x49a67cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E04A99D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E049CF7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x049f61b3
0x049f61b5
0x049f61bd
0x049f61c3
0x049f61c7
0x049f61d2
0x049f61ff
0x049f61ff
0x049f6201
0x049f6207
0x049f6207
0x049f61d4
0x049f61d9
0x00000000
0x00000000
0x049f61df
0x049f61e2
0x00000000
0x00000000
0x049f61e6
0x049f61e8
0x049f61ee
0x049f61ee
0x049f61f9
0x04a3762f
0x04a37632
0x04a37635
0x04a37639
0x04a37640
0x04a3766e
0x04a37675
0x00000000
0x00000000
0x04a37681
0x04a37689
0x04a3768d
0x04a37691
0x04a37695
0x04a37699
0x04a376af
0x04a376b5
0x04a376b7
0x04a376b7
0x04a376d7
0x04a376dc
0x00000000
0x04a376dc
0x04a376a2
0x04a376a9
0x04a37651
0x04a37653
0x04a37653
0x04a37656
0x04a37656
0x00000000
0x04a37656
0x04a37644
0x04a37646
0x04a37648
0x04a37648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2460629f05ca51858ede546b83975ac8ec79b62607a2ed5583580e20feb97211
Instruction ID: 86098e11e19f20bd993e32f22466ead141fae36a0d385823485dedbc25089402
Opcode Fuzzy Hash: 2460629f05ca51858ede546b83975ac8ec79b62607a2ed5583580e20feb97211
Instruction Fuzzy Hash: 223136B16197019FD360DF19C950B2AB7E9EB88B10F05896DF9989B251E7B0F804CB91

Uniqueness

Uniqueness Score: -1.00%

Function 049CAA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E049CAA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x4abd360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4ab7b9c; // 0x0
					_t53 = L049E4620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E04A0B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E04A0F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L049D6C59(_t53, _t51, _t58) != 0) {
							_t28 = E049F5E50(0x49ac338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E049FB230(_v32, _v28, 0x49ac2d8, 1,  &_v24);
								_t28 = E049CF7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x049caa25
0x049caa29
0x049caa2d
0x049caa30
0x049caa37
0x049caa3c
0x04a24458
0x04a24458
0x04a24472
0x04a24474
0x04a24476
0x049caa64
0x049caa74
0x04a2447c
0x04a24483
0x04a24492
0x049caa52
0x049caa54
0x049caa5e
0x04a244a8
0x04a244ad
0x04a244af
0x04a244b6
0x04a244b6
0x04a244b9
0x04a244bc
0x04a244cd
0x04a244d3
0x04a244d6
0x04a244e1
0x04a244e1
0x04a244e6
0x04a244e8
0x04a244fb
0x04a244fb
0x04a244e8
0x00000000
0x049caa5e
0x04a24476
0x049caa42
0x049caa46
0x049caa48
0x049caa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd597640df1398377db70c6c991c065f7c15e657d30500ecf9f18358c6c0c789
Instruction ID: 0edab0dbaf713c1d991039bbdf95033e39ac41781c83f3d161b1faedfb09ec04
Opcode Fuzzy Hash: dd597640df1398377db70c6c991c065f7c15e657d30500ecf9f18358c6c0c789
Instruction Fuzzy Hash: 3831E071A00629AFDB119FA8CE41ABEB3B9EF48704B014479F901EB140E774B911DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A08EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04A08EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x4abd360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E049F4E70(0x4ab86e4, 0x4a09490, 0, 0);
					if( *0x4ab53e8 > 5 && E04A08F33(0x4ab53e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x4ab53e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x4ab53e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x49abc46;
						_t48 = E04A47B9C(0x4ab53e8, 0x49abc46, _t67, 0x4ab53e8, _t70,  &_v140);
					}
				}
				return E04A0B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x04a08ec7
0x04a08ed9
0x04a08edc
0x04a08ee6
0x04a08ee9
0x04a08eee
0x04a08efc
0x04a08f08
0x04a41349
0x04a41353
0x04a4135d
0x04a41366
0x04a4136f
0x04a41375
0x04a4137c
0x04a41385
0x04a41390
0x04a41391
0x04a4139c
0x04a4139d
0x04a413a6
0x04a413ac
0x04a413b2
0x04a413b5
0x04a413bc
0x04a413bf
0x04a413c2
0x04a413c5
0x04a413c8
0x04a413cb
0x04a413ce
0x04a413d1
0x04a413d4
0x04a413d7
0x04a413da
0x04a413dd
0x04a413e0
0x04a413e3
0x04a413e6
0x04a413e9
0x04a413f6
0x04a41400
0x04a41400
0x04a08f08
0x04a08f32

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b17269d1db5aabbf6773c88b39b1c51d15378e0a0980938dd11060dba74c225
Instruction ID: be3ec2b1719dcfb2884328d423b65da0bfc7cf9a8c2891f05f26d95ba92b5782
Opcode Fuzzy Hash: 2b17269d1db5aabbf6773c88b39b1c51d15378e0a0980938dd11060dba74c225
Instruction Fuzzy Hash: CE4191B1D00318ABDB10DFAAD980AEDFBF8FB48314F5081AEE559A7241E7746A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04A04A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04A04A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x4abd360 ^ _t62;
				_v8 =  *0x4abd360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E049E2280(_t26, 0x4ab8608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E049DFFB0(_t41, _t51, 0x4ab8608);
						L2:
						 *0x4abb1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E04A0B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E049E2280(_t28, 0x4ab8608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E049DFFB0(_t42, _t53, 0x4ab8608);
							if(_t53 != 0) {
								L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E049DFFB0(_t41, _t51, 0x4ab8608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x04a04a2c
0x04a04a34
0x04a04a3c
0x04a04a3e
0x04a04a48
0x04a04a4b
0x04a04a4d
0x04a04a51
0x04a04a9c
0x00000000
0x00000000
0x04a04aa3
0x04a04aa8
0x04a04aad
0x04a04ab1
0x04a04ade
0x04a04ae3
0x04a04a5a
0x04a04a62
0x04a04a6a
0x04a04a6e
0x04a3f203
0x04a04a84
0x04a04a88
0x04a04a89
0x04a04a8a
0x04a04a95
0x04a04a95
0x04a04a79
0x04a04a80
0x04a04af2
0x04a04af4
0x04a04af9
0x04a04aff
0x04a04b01
0x04a04b03
0x04a04b08
0x04a3f20a
0x04a3f212
0x04a3f216
0x04a3f216
0x04a04b08
0x04a04b13
0x04a04b1a
0x04a3f229
0x04a3f229
0x04a04b1a
0x04a04a82
0x00000000
0x04a04a82
0x04a04ab7
0x04a04acd
0x04a04acd
0x04a04ad5
0x04a04ada
0x00000000
0x04a04ada
0x04a04ac2
0x04a04acb
0x00000000
0x00000000
0x00000000
0x04a04acb
0x04a04a53
0x04a04a53
0x04a04a58
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62828a505ad4f71f437203768cde48ae890727285cc4a48423b8cf10b6bb3cc9
Instruction ID: 6235bd737e330aeb1d6dbec16886692c49b71812979db19427c3253c0c9e9d14
Opcode Fuzzy Hash: 62828a505ad4f71f437203768cde48ae890727285cc4a48423b8cf10b6bb3cc9
Instruction Fuzzy Hash: 16310232605710EFD721EF58D980B2ABBA8FFC9714F44896DEA560B281D774F800CB85

Uniqueness

Uniqueness Score: -1.00%

Function 049FE730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E049FE730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E04A09670() < 0) {
					L04A1DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4ab7b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L049E4620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M049FE810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x049fe730
0x049fe736
0x049fe738
0x049fe73d
0x049fe73e
0x049fe740
0x049fe749
0x049fe765
0x049fe76a
0x049fe76b
0x049fe76c
0x049fe76d
0x049fe76e
0x049fe76f
0x049fe775
0x049fe777
0x049fe77e
0x04a3b675
0x049fe784
0x049fe784
0x049fe789
0x049fe7a8
0x049fe7ac
0x049fe807
0x049fe7ae
0x049fe7ae
0x049fe7b1
0x049fe7b4
0x049fe7b9
0x049fe7c0
0x049fe7c4
0x049fe7ca
0x049fe7cc
0x00000000
0x049fe7d3
0x049fe7d6
0x00000000
0x00000000
0x049fe7ff
0x049fe802
0x00000000
0x00000000
0x049fe7f9
0x049fe7fc
0x00000000
0x00000000
0x049fe7f3
0x049fe7f6
0x00000000
0x00000000
0x049fe7ed
0x049fe7f0
0x00000000
0x00000000
0x049fe7e7
0x049fe7ea
0x00000000
0x00000000
0x04a3b685
0x04a3b688
0x00000000
0x00000000
0x04a3b682
0x00000000
0x00000000
0x049fe7cc
0x049fe7d9
0x049fe7dc
0x049fe7de
0x049fe7de
0x049fe7ac
0x049fe7e4
0x049fe74b
0x049fe751
0x049fe759
0x049fe761
0x049fe761

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbc00fc33ce55ecbe05bed827202f89502ec46e4da5552e1243c3905926c83f
Instruction ID: a06631ff4798e88b33c73516b35cfbe1471fc5d07cd064f10e3167f7fe973c63
Opcode Fuzzy Hash: 4bbc00fc33ce55ecbe05bed827202f89502ec46e4da5552e1243c3905926c83f
Instruction Fuzzy Hash: F3318D75A14249EFDB04CF18D841B9ABBE9FB58314F148666FA04CB351E631FD80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 049FBC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E049FBC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4ab6100; // 0x6
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E049E2280(0xd, 0x1758f1a0);
				_t41 =  *0x4ab60f8; // 0x0
				if(_t41 != 0) {
					 *0x4ab60f8 =  *_t41;
					 *0x4ab60fc =  *0x4ab60fc + 0xffff;
				}
				E049DFFB0(_t41, 0x800, 0x1758f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x4ab60f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L049E4620(0x4ab6100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4ab6100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x049fbc36
0x049fbc42
0x049fbc45
0x049fbc4a
0x049fbd35
0x00000000
0x00000000
0x00000000
0x00000000
0x049fbc50
0x049fbc50
0x049fbc58
0x049fbc5a
0x049fbc60
0x00000000
0x00000000
0x04a3a4f2
0x04a3a4f6
0x00000000
0x00000000
0x00000000
0x04a3a4fc
0x049fbc79
0x049fbc7e
0x049fbc86
0x049fbd16
0x049fbd20
0x049fbd20
0x049fbc8d
0x049fbc94
0x049fbcbd
0x049fbcca
0x049fbccb
0x049fbccc
0x049fbccd
0x049fbcce
0x049fbcd4
0x049fbcea
0x049fbcee
0x049fbcf2
0x049fbd00
0x049fbd04
0x00000000
0x049fbc96
0x049fbcab
0x049fbcaf
0x049fbd2c
0x049fbd2c
0x049fbd09
0x00000000
0x049fbd09
0x049fbcb1
0x049fbcb5
0x049fbcbb
0x00000000
0x00000000
0x00000000
0x049fbcbb

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75cf6d1c6a81c2196ef5fcb87d84ba19d59b74e1c8e8eefb4cb3cd8c19c3a9f
Instruction ID: 862c21f2aa69dc3b4e25f12dcbaea73c9cffc71224d799cde23ab59a750223f2
Opcode Fuzzy Hash: c75cf6d1c6a81c2196ef5fcb87d84ba19d59b74e1c8e8eefb4cb3cd8c19c3a9f
Instruction Fuzzy Hash: D531F276600A159BEB11DF58D8807A673A8FF18315F044479EE45DB202E778FD06CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 049F1DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E049F1DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E049EF460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L049E4620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E049EF460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x049f1dc2
0x049f1dc5
0x049f1dc7
0x049f1dcc
0x049f1dce
0x049f1dd6
0x049f1ddf
0x049f1de0
0x049f1de1
0x049f1de5
0x049f1de8
0x049f1def
0x049f1df0
0x049f1df6
0x049f1df7
0x049f1dfe
0x049f1e1a
0x00000000
0x00000000
0x049f1e0b
0x049f1e12
0x049f1e12
0x049f1e00
0x049f1e00
0x049f1e05
0x049f1e1e
0x049f1e23
0x04a3570f
0x04a35713
0x00000000
0x00000000
0x04a35719
0x04a35719
0x049f1e2c
0x049f1e2d
0x049f1e2e
0x049f1e2f
0x049f1e31
0x049f1e32
0x049f1e35
0x049f1e3d
0x04a35723
0x04a3573d
0x04a3573d
0x00000000
0x04a35723
0x049f1e49
0x049f1e4e
0x049f1e4e
0x049f1e09
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: ed079fb80342607c7a3c01c440b0e5c61497c90b488f1a95c0ac4f30a257d1d6
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: D7218D72A00118FFD725CF99CC85EAABBBDEF85744F114465EA0197220EA30BE01DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 049C9100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E049C9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x4a9f6e8);
				E04A1D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E04A988F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E04A1D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x4ab86c0; // 0x2dc07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x4ab86b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E049E2280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E04A988F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E04A0AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x4abb1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x4ab84c0;
										if(_t69 >=  *0x4ab84c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E04A99063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E049C922A(_t82);
							_t53 = E049E7D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E04A98B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x4ab86c0; // 0x2dc07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x4ab86b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x4ab86bc;
										_t72 = 0x4ab86b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E049C9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x4ab86c4;
									_t72 = 0x4ab86c0;
									L18:
									E049F9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x049c9100
0x049c9100
0x049c9100
0x049c9100
0x049c9102
0x049c9107
0x049c910c
0x049c9110
0x049c9115
0x049c9136
0x049c9143
0x04a237e4
0x04a237e4
0x049c9149
0x049c914e
0x049c914e
0x049c9117
0x049c911d
0x00000000
0x00000000
0x049c911f
0x049c9125
0x00000000
0x049c9151
0x049c9158
0x049c915d
0x049c9161
0x049c9168
0x04a23715
0x00000000
0x049c916e
0x049c916e
0x049c9175
0x049c9177
0x049c917e
0x049c917f
0x049c9182
0x049c9182
0x049c9187
0x049c9187
0x049c918a
0x049c918d
0x049c918f
0x049c9192
0x049c9195
0x049c9198
0x049c9198
0x049c9198
0x049c919a
0x00000000
0x00000000
0x04a2371f
0x04a23721
0x04a23727
0x04a2372f
0x04a23733
0x04a23735
0x04a23738
0x04a2373b
0x04a2373d
0x04a23740
0x00000000
0x00000000
0x04a23746
0x04a23749
0x00000000
0x00000000
0x04a2374f
0x04a23751
0x00000000
0x00000000
0x04a23757
0x04a23759
0x04a2375c
0x04a2375c
0x04a2375e
0x04a2375e
0x04a23761
0x04a23764
0x00000000
0x00000000
0x04a23766
0x04a23768
0x04a237a3
0x04a237a3
0x04a237a5
0x04a237a7
0x04a237ad
0x04a237b0
0x04a237b2
0x04a237bc
0x04a237c2
0x04a237c2
0x04a237b2
0x049c9187
0x049c9187
0x049c918a
0x049c918d
0x049c918f
0x049c9192
0x049c9195
0x00000000
0x049c9195
0x00000000
0x049c9187
0x04a2376a
0x04a2376a
0x04a2376c
0x04a2376c
0x04a2376f
0x04a23775
0x00000000
0x00000000
0x04a23777
0x04a23779
0x00000000
0x00000000
0x04a23782
0x04a23787
0x04a23789
0x04a23790
0x04a23790
0x04a2378b
0x04a2378b
0x04a2378b
0x04a23792
0x04a23795
0x04a23795
0x04a23798
0x04a23798
0x04a2379b
0x04a2379b
0x049c91a3
0x049c91a9
0x049c91b0
0x049c91b4
0x049c91b4
0x049c91bb
0x049c91c0
0x049c91c5
0x049c91c7
0x04a237da
0x049c91cd
0x049c91cd
0x049c91cd
0x049c91d2
0x049c91d5
0x049c9239
0x049c9239
0x049c91d7
0x049c91db
0x049c91e1
0x049c91e7
0x049c91fd
0x049c9203
0x049c921e
0x049c9223
0x00000000
0x049c9223
0x049c9205
0x049c9208
0x049c920c
0x049c9214
0x049c9214
0x049c91e9
0x049c91e9
0x049c91ee
0x049c91f3
0x049c91f3
0x049c91f3
0x049c91e7
0x00000000
0x049c91db
0x049c9187
0x049c9168

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224236ec6a497f3be8dbd16d48b58f4c795dcb7fd21f5f7d83f939b7ac67852a
Instruction ID: 2ac1e816a31729646a889aaccc9bb4dde3d6d25536ac159b64e02b46102c66f8
Opcode Fuzzy Hash: 224236ec6a497f3be8dbd16d48b58f4c795dcb7fd21f5f7d83f939b7ac67852a
Instruction Fuzzy Hash: B731C0B1A00284DFEB21DF68C589BACB7F5BB49324F18856DC40467251D338B980CB92

Uniqueness

Uniqueness Score: -1.00%

Function 049E0050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E049E0050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x4abd360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E049F9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E04A0B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E04A98A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E049F9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x4abb1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x049e0055
0x049e005d
0x049e0062
0x049e006c
0x049e006f
0x049e0074
0x049e007a
0x049e007a
0x049e0080
0x049e0080
0x049e0087
0x049e008d
0x049e008f
0x049e0093
0x049e0095
0x049e009b
0x049e00f8
0x049e00fb
0x049e00fc
0x049e00ff
0x049e0108
0x049e0108
0x049e00a2
0x049e00a6
0x049e00b3
0x049e00bc
0x049e00c5
0x049e00ca
0x04a2c01e
0x00000000
0x00000000
0x04a2c02d
0x049e00d5
0x049e00d9
0x04a2c03d
0x04a2c046
0x04a2c046
0x049e00df
0x049e00e2
0x049e00ea
0x049e00ef
0x049e00f2
0x049e00f6
0x049e0111
0x049e0117
0x049e0117
0x00000000
0x049e00f6
0x049e00d0
0x049e00d0
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829eccee1e27b3890a5eb9afdca2800f49b3766ccba454796bd1c21c684823d3
Instruction ID: 1c7b7fc1d225f9db919b44d1443f84788da7dbb2055f1684273dff2888acd6d6
Opcode Fuzzy Hash: 829eccee1e27b3890a5eb9afdca2800f49b3766ccba454796bd1c21c684823d3
Instruction Fuzzy Hash: D6318E31601B14CFD722CF29C944BAAB3E5FF88719F14496DE59687A90EB75BC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A46C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04A46C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E049E7D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4ab7b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L049E4620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E04A0F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E049E7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E04A09AE0();
						_t23 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x04a46c0a
0x04a46c0f
0x04a46c10
0x04a46c13
0x04a46c15
0x04a46c19
0x04a46c1c
0x04a46c21
0x04a46c28
0x04a46c3a
0x04a46c2a
0x04a46c33
0x04a46c33
0x04a46c3f
0x04a46c48
0x04a46c4d
0x04a46c60
0x04a46c65
0x04a46c69
0x04a46c73
0x04a46c79
0x04a46c7f
0x04a46c86
0x04a46c90
0x04a46c94
0x04a46ca6
0x04a46cb2
0x04a46cbd
0x04a46cbd
0x04a46cc3
0x04a46cc7
0x04a46ccb
0x04a46cd0
0x04a46cd1
0x04a46ce2
0x04a46ce2
0x04a46c69
0x04a46ced

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d3524f3124a4653ea3fe050dc7d02aaee4207bc0ab98146bd726de777f38aa
Instruction ID: 24d1da8fa4fb223961e7556de47db6ffdc55cd888be0e5c45d65281bf9ad5897
Opcode Fuzzy Hash: 80d3524f3124a4653ea3fe050dc7d02aaee4207bc0ab98146bd726de777f38aa
Instruction Fuzzy Hash: E921BCB1A00644AFD716DF69D980F6AB7B8FF88704F0440AAF804D7791D638ED50CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04A090AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E04A090AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E04A1D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E049FE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L049E4620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E04A0F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E049FA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x04a090af
0x04a090b8
0x04a090bb
0x04a090bf
0x04a090c2
0x04a090c2
0x04a090c8
0x04a090cb
0x04a090cd
0x04a414d7
0x04a414eb
0x04a414eb
0x00000000
0x04a414eb
0x04a414db
0x04a414e6
0x00000000
0x04a414f2
0x04a414e8
0x00000000
0x04a414e8
0x04a090d8
0x04a090da
0x04a090dd
0x04a090e5
0x00000000
0x04a09139
0x04a090fa
0x04a090fe
0x04a09142
0x00000000
0x04a09142
0x04a09104
0x04a09107
0x04a0910b
0x04a09110
0x04a09118
0x04a09147
0x04a09148
0x04a0914f
0x04a09150
0x04a09151
0x04a09152
0x04a09156
0x04a0915d
0x04a09160
0x04a09168
0x04a0916c
0x04a091bc
0x04a091be
0x00000000
0x04a091be
0x04a0916e
0x04a09173
0x04a09176
0x00000000
0x00000000
0x04a0917c
0x04a09180
0x04a091b5
0x00000000
0x04a091b5
0x04a09182
0x04a09185
0x04a09189
0x00000000
0x00000000
0x04a0918e
0x04a09190
0x04a09198
0x00000000
0x00000000
0x04a091a0
0x00000000
0x04a091ad
0x04a091ad
0x04a091b0
0x04a091b1
0x00000000
0x04a09185
0x04a0911a
0x04a0911c
0x04a0911f
0x04a09125
0x04a09127
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 2c721f1c7a6e72404bfd386d64e9d52453d22710bd2fbc0570df9ecd0d34484c
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 1F217FB1A01204EFDB20DF59D944AAAB7FCEB88314F14C86AE945A7251D270B9408B90

Uniqueness

Uniqueness Score: -1.00%

Function 049F3B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E049F3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x4ab84c4; // 0x0
				_v12 = 1;
				_v8 =  *0x4ab84c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x4ab84c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E04A0AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E04A0FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x4ab84c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x4ab84c4; // 0x0
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x049f3b89
0x049f3b96
0x049f3ba1
0x049f3bab
0x049f3bb5
0x049f3bb9
0x04a36298
0x049f3bbf
0x049f3bc2
0x049f3bc3
0x049f3bc9
0x049f3bca
0x049f3bcc
0x049f3bcd
0x049f3bd4
0x049f3bd6
0x049f3bdb
0x049f3bea
0x049f3bf7
0x049f3bfb
0x049f3bff
0x049f3c09
0x049f3c0a
0x049f3c0b
0x049f3c0f
0x049f3c14
0x049f3c18
0x049f3c18
0x049f3bfb
0x049f3c1b
0x049f3c30
0x049f3c30
0x049f3c3d

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd90213efb1621189cc8e95e95e5bed1dbf044292bceb7a8418cde6270552d3
Instruction ID: 9ae1071b8ac1d9fec73ef4c625328d2a81552bf40f6bcc04a7ecbbbe67bd0e89
Opcode Fuzzy Hash: 7bd90213efb1621189cc8e95e95e5bed1dbf044292bceb7a8418cde6270552d3
Instruction Fuzzy Hash: D1218E72A00108AFD715EF98DD81B6AB7BDFB44708F150478EA08AB252D379BD128B90

Uniqueness

Uniqueness Score: -1.00%

Function 04A46CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04A46CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E049E7D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E049E7D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x49a5c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E049FF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E049FF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E04A47016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L049E2400( &_v52);
								}
								_t21 = L049E2400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x04a46cfb
0x04a46d00
0x04a46d02
0x04a46d06
0x04a46d0a
0x04a46d0e
0x04a46d19
0x04a46d2b
0x04a46d1b
0x04a46d24
0x04a46d24
0x04a46d33
0x04a46d39
0x04a46d46
0x04a46d4f
0x04a46d61
0x04a46d51
0x04a46d5a
0x04a46d5a
0x04a46d69
0x04a46d6b
0x04a46d6d
0x04a46d6f
0x04a46d6f
0x04a46d74
0x04a46d79
0x04a46d7a
0x04a46d7f
0x04a46d82
0x04a46d88
0x04a46d89
0x04a46d90
0x04a46d94
0x04a46da7
0x04a46db1
0x04a46db1
0x04a46dbb
0x04a46dbb
0x04a46d90
0x04a46d69
0x04a46d46
0x04a46dc6

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7554b5502f79974772b557395e558eeb0f49f266fafb8b5d5309ee91ba57b89b
Instruction ID: 8e0148c470834ea75c498bd9d61af4aa0e29267f94da27f5c93626f4ece5d228
Opcode Fuzzy Hash: 7554b5502f79974772b557395e558eeb0f49f266fafb8b5d5309ee91ba57b89b
Instruction Fuzzy Hash: 3621B072504B489BD712DF69C944B6BB7ECAFC2754F040566B94087251EB38E908C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 04A9070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E04A9070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E04A907DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E04A8AFDE( &_v8,  &_v12);
					E04A91293(_t38, _v28, _t60);
					if(E049E7D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E04A814FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x04a9071b
0x04a90724
0x04a90734
0x04a90738
0x04a9074b
0x04a9074b
0x04a90753
0x04a90753
0x04a90759
0x04a9075d
0x04a90774
0x04a90779
0x04a9077d
0x04a90789
0x04a90795
0x04a907a7
0x04a90797
0x04a907a0
0x04a907a0
0x04a907af
0x04a907c4
0x04a907cd
0x04a907cd
0x04a907af
0x04a907dc

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 90e6291210ff6795476c1a48d351c47fd4ad7dbf9a0cf74417461e7a234db2e8
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: DB21F276208604AFDB05DF18C880A6ABBE5EBC4360F048569F9958B381D630ED09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 049EAE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E049EAE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E049E7D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E049E7D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E049E7D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E049E7D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E04A47794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x049eae78
0x049eae7c
0x049eae7e
0x049eae81
0x049eae86
0x049eae8d
0x04a32691
0x049eae93
0x049eae93
0x049eae93
0x049eae98
0x049eae9d
0x04a326a2
0x04a326b4
0x04a326a4
0x04a326ad
0x04a326ad
0x04a326b9
0x00000000
0x04a326bb
0x00000000
0x04a326bb
0x049eaea3
0x049eaea3
0x049eaea3
0x049eaeaa
0x04a326c0
0x04a326c9
0x04a326c9
0x049eaeb3
0x04a326d4
0x04a326e1
0x00000000
0x00000000
0x04a326e7
0x04a326ee
0x04a326f0
0x04a326f9
0x04a326f9
0x04a32702
0x04a32708
0x04a32708
0x04a3270b
0x04a3270f
0x04a32711
0x04a32711
0x04a32725
0x04a32725
0x00000000
0x049eaeb9
0x049eaeb9
0x049eaebf
0x049eaebf
0x049eaeb3

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 0e8db8bd1ceb9dfe478b17f477873e34c56cace21ed9d955480158fc8c90f221
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: FC21D172601684DFEB269B6AC948B3577E9EF84344F0900F5ED048B6A2F738FC40C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A47794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E04A47794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4ab7b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E04A0F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E049E7D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E04A09AE0();
					_t24 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x04a47799
0x04a4779a
0x04a4779b
0x04a477a3
0x04a477ab
0x04a477ae
0x04a477b1
0x04a477b1
0x04a477bf
0x04a477c4
0x04a477c8
0x04a477ce
0x04a477d4
0x04a477e0
0x04a477e0
0x04a477d6
0x04a477d6
0x04a477de
0x00000000
0x00000000
0x04a477de
0x04a477e5
0x04a477f0
0x04a477f3
0x04a477f6
0x04a477fd
0x04a47800
0x04a4780c
0x04a47818
0x04a4782b
0x04a4781a
0x04a47823
0x04a47823
0x04a47830
0x04a47831
0x04a47838
0x04a4783d
0x04a4783e
0x04a4784f
0x04a4784f
0x04a4785a

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0306ff1cf49df1b836a4536cc2e37e3eacfe85fd94cd9aafbf722cb0fdf60962
Instruction ID: 672410f523107a8e22520b3705329cf1b3eb6438dabf5d5a3c2b76ec13b737ba
Opcode Fuzzy Hash: 0306ff1cf49df1b836a4536cc2e37e3eacfe85fd94cd9aafbf722cb0fdf60962
Instruction Fuzzy Hash: 6E219D76900644ABC725DFA9D890EABB7A8EFC8750F104569F50AD7690E734E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 049FFD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E049FFD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E049D76E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x049ffd9b
0x049ffda0
0x049ffda1
0x049ffdab
0x049ffdad
0x049ffdb0
0x049ffdb8
0x049ffe0f
0x049ffde6
0x049ffde9
0x049ffdec
0x04a3c0c0
0x049ffdfe
0x049ffe06
0x049ffe06
0x04a3c0c8
0x049ffe2d
0x049ffe2d
0x00000000
0x049ffe2d
0x04a3c0d1
0x04a3c0e0
0x04a3c0e5
0x04a3c0e5
0x04a3c0e8
0x00000000
0x04a3c0e8
0x049ffdf4
0x00000000
0x00000000
0x049ffdf6
0x049ffdfa
0x049ffe1a
0x049ffe1f
0x049ffe1f
0x049ffdfc
0x00000000
0x049ffdfc
0x049ffdcc
0x049ffdd0
0x049ffe26
0x00000000
0x049ffe26
0x049ffdd8
0x049ffddb
0x049ffddd
0x049ffde0
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 82155c2423f13463d1616e1a7cbaa48205cac79896cd53b643796dd656571f79
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: AF218E72A00A40DFD735CF4AD944E66F7E9EB94B10F2585BEEA4587619E730BC00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 049C9240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E049C9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x4a9f708);
				E04A1D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E04A095D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E04A095D0();
				_t33 =  *0x4ab84c4; // 0x0
				L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x4ab84c4; // 0x0
				L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x4ab84c4; // 0x0
				E049E2280(L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x4ab86b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E04A095D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E04A095D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E049C9325();
					_t50 =  *0x4ab84c4; // 0x0
					return E04A1D0D1(L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x049c9240
0x049c9242
0x049c9247
0x049c924c
0x049c924e
0x049c9255
0x049c9257
0x049c925a
0x049c925f
0x049c925f
0x049c9266
0x049c9271
0x049c9276
0x049c9279
0x049c927e
0x049c9295
0x049c929a
0x049c92b1
0x049c92b6
0x049c92d7
0x049c92dc
0x049c92e0
0x049c92e6
0x049c92e8
0x049c92ee
0x049c9332
0x049c9333
0x049c9337
0x049c9338
0x049c933a
0x049c933a
0x049c933d
0x049c9342
0x049c9342
0x049c9345
0x049c9349
0x049c934e
0x049c9352
0x049c9357
0x049c92f4
0x049c92f4
0x049c92f6
0x049c92f9
0x049c9300
0x049c9306
0x049c9324
0x049c9324

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 92b4f21bffb20a948abb84d2ece2e40507b963c3f5d5558ba770a626f1755b51
Instruction ID: 8df58b4a50737564f6542a9e184744b6bcaff7c304ae27cbea819194c02af79e
Opcode Fuzzy Hash: 92b4f21bffb20a948abb84d2ece2e40507b963c3f5d5558ba770a626f1755b51
Instruction Fuzzy Hash: F0214A71041A00DFD726EF68DA00F16B7B9FF48708F0449ACA049866B2C739F942CB85

Uniqueness

Uniqueness Score: -1.00%

Function 049FB390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E049FB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E049E2280(_t12, 0x4ab8608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E04A000C2(0x4ab8608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x049fb395
0x049fb3a2
0x049fb3a5
0x049fb3aa
0x049fb3b2
0x049fb3ba
0x049fb3bd
0x049fb3c0
0x049fb3c4
0x049fb3c9
0x04a3a3e9
0x04a3a3ed
0x04a3a3f0
0x04a3a3ff
0x04a3a403
0x04a3a409
0x00000000
0x00000000
0x04a3a40b
0x04a3a40b
0x04a3a40f
0x04a3a415
0x04a3a423
0x04a3a423
0x04a3a415
0x049fb3d1
0x049fb3e8
0x049fb3e8
0x049fb3d9

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe56ebba3a7cfb7c469af56bdef898f263c31d8bf1976d7197a1b36b024b955
Instruction ID: 4c33c64a75c90ae98a6af4b9ef786f2973371e063506993e90cedfc27db0a3cf
Opcode Fuzzy Hash: 6fe56ebba3a7cfb7c469af56bdef898f263c31d8bf1976d7197a1b36b024b955
Instruction Fuzzy Hash: EC1188333021209BDB199E19DD80A6BB29FEBC5330B24053DEA5687380E931BC02C3C0

Uniqueness

Uniqueness Score: -1.00%

Function 04A54257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E04A54257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x4aa08d0);
				E04A1D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E04A541E8(__ebx, __edi, __ecx, _t39);
				E049DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x4ab87e4;
					_t18 =  *0x4ab87e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4ab5cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x4ab87e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x4ab87e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L049C7055(_t31 + 0xfffffff8);
								_t24 =  *0x4ab87e0; // 0x0
								_t18 = _t24 - 1;
								 *0x4ab87e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4ab5cd0;
				if( *0x4ab5cd0 <= 0) {
					L049C7055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x4ab87e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x4ab87e8 = _t30;
						 *0x4ab87e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E04A1D0D1(L04A54320());
			}

0x04a54257
0x04a54257
0x04a54257
0x04a54259
0x04a5425e
0x04a54263
0x04a54265
0x04a54273
0x04a54278
0x04a5427c
0x04a5427f
0x04a54281
0x04a54287
0x04a542d7
0x04a542d7
0x04a542da
0x04a5428d
0x04a5428d
0x04a5428f
0x04a54292
0x04a54297
0x04a5429c
0x04a542a0
0x04a542a6
0x04a542a8
0x04a542ae
0x04a542b3
0x00000000
0x04a542ba
0x04a542ba
0x04a542bf
0x04a542c5
0x04a542ca
0x04a542cf
0x04a542d0
0x00000000
0x04a542d0
0x04a542b3
0x00000000
0x04a542a6
0x04a5429c
0x04a542dc
0x04a542dc
0x04a542e3
0x04a54309
0x04a542e5
0x04a542e5
0x04a542e8
0x04a542ee
0x04a542f0
0x00000000
0x04a542f2
0x04a542f2
0x04a542f4
0x04a542f7
0x04a542f9
0x04a54300
0x04a54300
0x04a542f0
0x04a5430e
0x04a5431f

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86bf8961f8486e81af12423e12f9bead0f9915f27a2301d9a33e13257d926b3
Instruction ID: dae1dce080bf71ee29f41fe632bcb244b973486db2d75334b313c7e692dd9f77
Opcode Fuzzy Hash: c86bf8961f8486e81af12423e12f9bead0f9915f27a2301d9a33e13257d926b3
Instruction Fuzzy Hash: CE211DB0501B11DFD715EF59E2006587BF9FB99319F1081AEC9198F271D739A8D2CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04A446A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04A446A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E04A0F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E049FD268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L049E77F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x04a446b7
0x04a446ba
0x04a446c5
0x04a446c8
0x04a446d0
0x04a446d4
0x04a446e6
0x04a446e9
0x04a446f4
0x04a446ff
0x04a44705
0x04a44706
0x04a4470c
0x04a44713
0x04a4471b
0x04a44723
0x04a44725
0x04a446d6
0x04a446d9
0x04a446db
0x04a446db
0x04a44732

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: d7b2f0052ce27b27298315a55261106ee0e773c0a45f5d3ed76cc435a9716cb8
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: E1110272504208BBDB059F5DA8809BEB7B9EFC9304F1080AAF94487350DA319D51D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 049F2397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E049F2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x4ab848c != 0) {
					L049EFAD0(0x4ab8610);
					if( *0x4ab848c == 0) {
						E049EFA00(0x4ab8610, _t19, _t27, 0x4ab8610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E049F2581(0x4ab8610, 0x49a50a0, _t26, _t27, _t28);
						E049EFA00(0x4ab8610, 0x49a50a0, _t27, 0x4ab8610);
					}
				} else {
					L1:
					_t11 =  *0x4ab8614; // 0x0
					if(_t11 == 0) {
						_t11 = E04A04886(0x49a1088, 1, 0x4ab8614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E049F2581(0x4ab8610, (_t11 << 4) + 0x49a5070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x049f23b0
0x049f23b6
0x049f2409
0x049f2415
0x04a35ae9
0x00000000
0x049f241b
0x049f241b
0x049f241d
0x049f2427
0x049f242e
0x049f2430
0x049f2430
0x049f23b8
0x049f23b8
0x049f23b8
0x049f23bf
0x049f23fc
0x049f23fc
0x049f23c1
0x049f23c3
0x049f23d0
0x049f23d8
0x049f23d8
0x049f23dc
0x049f23de
0x049f23e1
0x049f23e1
0x049f23ec

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c381a11cdd7f3926e329e77b4e254f1b5cf978454973ec645cf61eb84c33e18
Instruction ID: f52c670c11eb5b81dea870e4a4ffd61b8f47c5255269b967a9a8e96254b12100
Opcode Fuzzy Hash: 4c381a11cdd7f3926e329e77b4e254f1b5cf978454973ec645cf61eb84c33e18
Instruction Fuzzy Hash: ED11087270031077F720BB2E9C50B26B6CDEB90B24F14487AF706AB191E5B9F8059795

Uniqueness

Uniqueness Score: -1.00%

Function 04A037F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04A037F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E049E2280(_t6, 0x4ab8550);
				}
				_t29 = E04A0387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E049DFFB0(0x4ab8550, _t27, 0x4ab8550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x04a037fa
0x04a037fc
0x04a03805
0x04a03808
0x04a03808
0x04a03814
0x04a03818
0x04a03846
0x04a03848
0x04a0384b
0x04a0384b
0x04a03852
0x00000000
0x04a03854
0x04a03856
0x00000000
0x00000000
0x04a03863
0x00000000
0x04a03863
0x04a0381a
0x04a0381a
0x04a0381f
0x04a0386e
0x04a0386e
0x04a03871
0x04a03873
0x04a03873
0x04a03868
0x00000000
0x04a03868
0x04a03821
0x04a03826
0x00000000
0x00000000
0x04a03828
0x04a0382a
0x04a03841
0x00000000
0x04a03841

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71be3a435f0a9bd4eb0ae7fba727f19e83c32aa45aea3d305422e0ef2eb9f422
Instruction ID: ecd4891646cb99c9fc452fd429d7d9c503a916c04c748307624801003e4102ef
Opcode Fuzzy Hash: 71be3a435f0a9bd4eb0ae7fba727f19e83c32aa45aea3d305422e0ef2eb9f422
Instruction Fuzzy Hash: F501C472A016109BDB3B8B5AA940A26BBAADFC5B50B15C0E9EC458B291D730E805C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 049CC962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E049CC962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x4abd360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E049DEEF0(0x4ab70a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E04A4F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E049DEB70(_t29, 0x4ab70a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E04A0B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E04A4F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x4ab70c0; // 0x0
					while(_t38 != 0x4ab70c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x4abb1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x049cc96a
0x049cc974
0x049cc988
0x049cc98a
0x04a37c9d
0x04a37c9f
0x04a37ca4
0x04a37cae
0x04a37cf0
0x04a37cf5
0x04a37cfa
0x049cc992
0x049cc996
0x049cc997
0x049cc998
0x049cc9a3
0x049cc9a3
0x04a37cb0
0x04a37cb7
0x04a37cbb
0x00000000
0x00000000
0x04a37cbd
0x04a37ce8
0x04a37cc5
0x04a37cc8
0x04a37cca
0x04a37cd0
0x04a37cd6
0x04a37cde
0x04a37ce4
0x04a37ce4
0x04a37cd0
0x00000000
0x04a37ce8
0x049cc990
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e149dde586fa56b1810919077b910207f510df7680ae5e1ebacd6ab3a1b3cb4
Instruction ID: 86d148cc2c73ad2f7c6b6563cbce30ea4fa741ac7d594a59850ab52cba83c9b7
Opcode Fuzzy Hash: 6e149dde586fa56b1810919077b910207f510df7680ae5e1ebacd6ab3a1b3cb4
Instruction Fuzzy Hash: 43112135300A469FDB10AF68DC84A6BB7E5FBC4A19F00453AF88583662EB60FC00DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 049F002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049F002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E049E7D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E049E7D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E049E7D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E049E7D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x049f0032
0x049f0037
0x049f0043
0x04a34b3a
0x049f0049
0x049f0049
0x049f0049
0x049f004e
0x049f0053
0x04a34b48
0x04a34b5a
0x04a34b4a
0x04a34b53
0x04a34b53
0x04a34b5f
0x00000000
0x04a34b61
0x00000000
0x04a34b61
0x049f0059
0x049f0059
0x049f0060
0x04a34b6f
0x04a34b6f
0x049f0069
0x04a34b83
0x00000000
0x00000000
0x04a34b90
0x04a34b9b
0x04a34b9b
0x04a34ba4
0x00000000
0x00000000
0x04a34baa
0x00000000
0x049f006f
0x049f006f
0x00000000
0x049f006f
0x049f0069

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: be443c04aeb58fc82b49b9a8c1114cad38a04d36651d54a7a96029d81edc1f7c
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: D511A932601680CFE7229F698D44B3537E9AB88759F0900F0EE048B6A2F328F881C361

Uniqueness

Uniqueness Score: -1.00%

Function 049D766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E049D766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E049FF3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E049FF3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L049E4620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x049d7672
0x049d767f
0x049d7689
0x049d76de
0x049d76de
0x049d768b
0x049d7691
0x049d7693
0x049d7697
0x00000000
0x049d7699
0x049d76a8
0x00000000
0x049d76aa
0x049d76ad
0x049d76b1
0x00000000
0x049d76b3
0x049d76b3
0x049d76b5
0x049d76ba
0x049d76bc
0x049d76bc
0x049d76c0
0x00000000
0x049d76c2
0x049d76ce
0x049d76ce
0x049d76c0
0x049d76b1
0x049d76a8
0x049d7697
0x049d76d9

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 204c4a00438e736da0f98dba26aee09fad86616e7c5add59fe3718a9b9d86d38
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: ED01843270011DAFD720AE9ECC41E5B77ADFB84BA0B644579B908CB254EA70ED0187A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A5C450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04A5C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E04A09910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E04A095B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E04A095D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E04A095D0();
				return L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x04a5c458
0x04a5c45d
0x04a5c466
0x04a5c468
0x04a5c469
0x04a5c46a
0x04a5c46b
0x04a5c46e
0x04a5c46f
0x04a5c471
0x04a5c476
0x04a5c476
0x04a5c47c
0x04a5c47e
0x04a5c480
0x04a5c480
0x04a5c483
0x04a5c484
0x04a5c486
0x04a5c488
0x04a5c48f
0x04a5c491
0x04a5c493
0x04a5c493
0x04a5c48f
0x04a5c498
0x04a5c49e
0x04a5c4ad
0x04a5c4ad
0x04a5c4b2
0x04a5c4b4
0x04a5c4cd

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 95e8604434e0333556bbb683726c8696ddcad59a05de74f5bf4fd3a59a87a85c
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 880180B2140605BFE625AF66DD84E63BB7DFB943A4F008525F514425B4CB32FCA1CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 049C9080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E049C9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x4ab85ec;
				E049E2280(_t48, 0x4ab85ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E049DFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x4ab538c; // 0x77f06848
					if( *_t84 != 0x4ab5388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x4a9f6e8);
						E04A1D0E8(0x4ab85ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E04A988F5(_t80, _t85, 0x4ab5388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x4ab86c0; // 0x2dc07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x4ab86b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E049E2280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E04A988F5(0x4ab85ec, _t85, 0x4ab5388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E04A0AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x4abb1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x4ab84c0;
																			if(_t82 >=  *0x4ab84c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E04A99063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E049C922A(_t99);
										_t64 = E049E7D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E04A98B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x4ab86c0; // 0x2dc07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x4ab86b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x4ab86bc;
													_t87 = 0x4ab86b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E049C9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x4ab86c4;
												_t87 = 0x4ab86c0;
												L27:
												E049F9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E04A1D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4ab5388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x4ab538c = _t51;
						goto L6;
					}
				}
			}

0x049c9082
0x049c9083
0x049c9084
0x049c9085
0x049c9087
0x049c9096
0x049c9098
0x049c9098
0x049c909e
0x049c90a8
0x049c90e7
0x049c90e7
0x049c90aa
0x049c90b0
0x049c90b7
0x049c90bd
0x049c90dd
0x049c90e6
0x049c90bf
0x049c90bf
0x049c90c7
0x049c90cf
0x049c90f1
0x049c90f2
0x049c90f4
0x049c90f5
0x049c90f6
0x049c90f7
0x049c90f8
0x049c90f9
0x049c90fa
0x049c90fb
0x049c90fc
0x049c90fd
0x049c90fe
0x049c90ff
0x049c9100
0x049c9102
0x049c9107
0x049c910c
0x049c9110
0x049c9113
0x049c9115
0x049c9136
0x049c913f
0x049c9143
0x04a237e4
0x04a237e4
0x049c9117
0x049c9117
0x049c911d
0x00000000
0x049c911f
0x049c911f
0x049c9125
0x00000000
0x049c9127
0x049c912d
0x049c9130
0x049c9134
0x049c9158
0x049c915d
0x049c9161
0x049c9168
0x04a23715
0x049c916e
0x049c916e
0x049c9175
0x049c9177
0x049c917e
0x049c917f
0x049c9182
0x049c9182
0x049c9187
0x049c9187
0x049c918a
0x049c918d
0x049c918f
0x049c9192
0x049c9195
0x049c9198
0x049c9198
0x049c9198
0x049c919a
0x00000000
0x00000000
0x04a2371f
0x04a23721
0x04a23727
0x04a2372f
0x04a23733
0x04a23735
0x04a23738
0x04a2373b
0x04a2373d
0x04a23740
0x00000000
0x04a23746
0x04a23746
0x04a23749
0x00000000
0x04a2374f
0x04a2374f
0x04a23751
0x04a23757
0x04a23759
0x04a2375c
0x04a2375c
0x04a2375e
0x04a2375e
0x04a23761
0x04a23764
0x00000000
0x00000000
0x04a23766
0x04a23768
0x04a237a3
0x04a237a3
0x04a237a5
0x04a237a7
0x04a237ad
0x04a237b0
0x04a237b2
0x04a237bc
0x04a237c2
0x04a237c2
0x04a237b2
0x049c9187
0x049c9187
0x049c918a
0x049c918d
0x049c918f
0x049c9192
0x049c9195
0x00000000
0x049c9195
0x00000000
0x04a2376a
0x04a2376a
0x04a2376a
0x04a2376c
0x04a2376c
0x04a2376f
0x04a23775
0x00000000
0x00000000
0x04a23777
0x04a23779
0x04a23782
0x04a23787
0x04a23789
0x04a23790
0x04a23790
0x04a2378b
0x04a2378b
0x04a2378b
0x04a23792
0x04a23795
0x00000000
0x04a23795
0x00000000
0x04a23779
0x04a23798
0x00000000
0x04a23798
0x00000000
0x04a23768
0x04a2379b
0x04a2379b
0x04a23751
0x04a23749
0x00000000
0x04a23740
0x049c91a0
0x049c91a3
0x049c91a9
0x049c91b0
0x00000000
0x049c91b0
0x049c9187
0x049c91b4
0x049c91b4
0x049c91bb
0x049c91c0
0x049c91c5
0x049c91c7
0x04a237da
0x049c91cd
0x049c91cd
0x049c91cd
0x049c91d2
0x049c91d5
0x049c9239
0x049c9239
0x049c91d7
0x049c91db
0x049c91e1
0x049c91e7
0x049c91fd
0x049c9203
0x049c921e
0x049c9223
0x00000000
0x049c9205
0x049c9205
0x049c9208
0x049c920c
0x049c9214
0x049c9214
0x049c920c
0x049c91e9
0x049c91e9
0x049c91ee
0x049c91f3
0x049c91f3
0x049c91f3
0x049c91e7
0x00000000
0x00000000
0x00000000
0x049c9134
0x049c9125
0x049c911d
0x049c914e
0x049c90d1
0x049c90d1
0x049c90d3
0x049c90d6
0x049c90d8
0x00000000
0x049c90d8
0x049c90cf

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10504d528b9679b650bf22d28a7d4790931ea48921b535eb462e1568235b97fc
Instruction ID: 5d80d77503b5b845a4019428136e5fc4c167a2d905edc1b79cc58951aba1c238
Opcode Fuzzy Hash: 10504d528b9679b650bf22d28a7d4790931ea48921b535eb462e1568235b97fc
Instruction Fuzzy Hash: F401F4B2A012009FE3199F08D840B217BADEB85329F25407AE1019B792C374FC41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04A94015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04A94015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E049E2280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E049E2280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x4ab86ac);
					E049CF900(0x4ab86d4, _t28);
					E049DFFB0(0x4ab86ac, _t28, 0x4ab86ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E049DFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x04a9401a
0x04a9401e
0x04a94023
0x04a94028
0x04a94029
0x04a9402b
0x04a9402f
0x04a94043
0x04a94046
0x04a94051
0x04a94057
0x04a9405f
0x04a94062
0x04a94067
0x04a9406f
0x04a9407c
0x04a9407c
0x04a9408c
0x04a9408c
0x04a94097

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d60cacc881e43db0b3532ec90e997c5c4ac79d8e42dfab608f9d5d57f3bfd71
Instruction ID: 471c86fce5692e2fb925d47d23da6f6c0e85bb72b038e23d825b42229eeda277
Opcode Fuzzy Hash: 0d60cacc881e43db0b3532ec90e997c5c4ac79d8e42dfab608f9d5d57f3bfd71
Instruction Fuzzy Hash: 580184722415457FE615AB69CD80E63B7ACFB89758B000679B50887A12DB24FC11C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 04A814FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E04A814FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x4abd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E04A0FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E049E7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x04a814fb
0x04a814fb
0x04a8150a
0x04a81514
0x04a81519
0x04a8151b
0x04a81526
0x04a8152c
0x04a81534
0x04a81537
0x04a8153a
0x04a81545
0x04a81557
0x04a81547
0x04a81550
0x04a81550
0x04a81562
0x04a81563
0x04a81565
0x04a8156a
0x04a8157f

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98c7185eb3b9bd0e15fd8a651e893634012f38f45e53a9614692b2e02758eee
Instruction ID: 0a39428aa9fde36089cd9145bf415cafd7ee261d9da9bce80ab96624f78bbb5a
Opcode Fuzzy Hash: c98c7185eb3b9bd0e15fd8a651e893634012f38f45e53a9614692b2e02758eee
Instruction Fuzzy Hash: DE019271A00248AFDB14EFA9D941EEEB7B8EF44704F40406AF904EB281D674EA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04A8138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E04A8138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x4abd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E04A0FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E049E7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x04a8138a
0x04a8138a
0x04a81399
0x04a813a3
0x04a813a8
0x04a813aa
0x04a813b5
0x04a813bb
0x04a813c3
0x04a813c6
0x04a813c9
0x04a813d4
0x04a813e6
0x04a813d6
0x04a813df
0x04a813df
0x04a813f1
0x04a813f2
0x04a813f4
0x04a813f9
0x04a8140e

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d51a6f654222cc4e72d08c887505fd12f6b9eace016c20d16a2a33421b4d086
Instruction ID: fb21f77068730c83d658f0388bbf3240e286f2a7f90cbff6f37dcb81a0172be3
Opcode Fuzzy Hash: 8d51a6f654222cc4e72d08c887505fd12f6b9eace016c20d16a2a33421b4d086
Instruction Fuzzy Hash: BB015271A00218AFDB14EFA9D941EAEB7B8EF44710F40406AB904EB281E674EA41C795

Uniqueness

Uniqueness Score: -1.00%

Function 049C58EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E049C58EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x4abd360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x49a5c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E049C5943() != 0 &&  *0x4ab5320 > 5) {
					E04A47B5E( &_v44, _t27);
					_t22 =  &_v28;
					E04A47B5E( &_v28, _t28);
					_t11 = E04A47B9C(0x4ab5320, 0x49abf15,  &_v28, _t22, 4,  &_v76);
				}
				return E04A0B640(_t11, _t17, _v8 ^ _t29, 0x49abf15, _t27, _t28);
			}

0x049c58fb
0x049c58fe
0x049c5906
0x049c590a
0x049c593c
0x049c593c
0x049c590c
0x049c590c
0x049c5911
0x00000000
0x049c5913
0x049c5913
0x049c5913
0x049c5911
0x049c591d
0x04a21035
0x04a2103c
0x04a2103f
0x04a21056
0x04a21056
0x049c593b

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5b4b52cbe726a6a886e104d337b88ad5d6bf13550ac0c5727b37e91226737c
Instruction ID: 8611704672c38cf191a0caae7b17afbe09737dea92f605638326959b18beafa1
Opcode Fuzzy Hash: bd5b4b52cbe726a6a886e104d337b88ad5d6bf13550ac0c5727b37e91226737c
Instruction Fuzzy Hash: 89018F71B00224BBE714EE69DD109AE77ADEB94238F9600B99906A7245EF30FD06C691

Uniqueness

Uniqueness Score: -1.00%

Function 04A7FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04A7FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x4abd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E04A0FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E049E7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04a7fec0
0x04a7fec0
0x04a7fecf
0x04a7fed9
0x04a7fede
0x04a7fee0
0x04a7feeb
0x04a7fef3
0x04a7fef6
0x04a7fef9
0x04a7ff04
0x04a7ff16
0x04a7ff06
0x04a7ff0f
0x04a7ff0f
0x04a7ff21
0x04a7ff22
0x04a7ff24
0x04a7ff29
0x04a7ff3e

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47108b36152892f7bc0e9eac71232931506a17cd837d5b33dee61038bd65ff81
Instruction ID: 32f3b6a21b499d2b68a36ba2cb8246620fe4d112b54ca5e889e2b94a01f18021
Opcode Fuzzy Hash: 47108b36152892f7bc0e9eac71232931506a17cd837d5b33dee61038bd65ff81
Instruction Fuzzy Hash: 3A018F71E00208AFDB14DBA9E945FAFBBB8EF44704F404066F900AB291EA74EA01C795

Uniqueness

Uniqueness Score: -1.00%

Function 04A7FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04A7FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x4abd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E04A0FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E049E7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04a7fe3f
0x04a7fe3f
0x04a7fe4e
0x04a7fe58
0x04a7fe5d
0x04a7fe5f
0x04a7fe6a
0x04a7fe72
0x04a7fe75
0x04a7fe78
0x04a7fe83
0x04a7fe95
0x04a7fe85
0x04a7fe8e
0x04a7fe8e
0x04a7fea0
0x04a7fea1
0x04a7fea3
0x04a7fea8
0x04a7febd

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3f6b085b11477801bc4c62b441b49c2fbd6d0c5fbe6130d86fa9baea6ee336
Instruction ID: 95308bec8b730d217e581db1c3c9405ae51afc9406b4e153231bf557d2f828aa
Opcode Fuzzy Hash: 2e3f6b085b11477801bc4c62b441b49c2fbd6d0c5fbe6130d86fa9baea6ee336
Instruction Fuzzy Hash: 30018471E00208AFDB14DFA9E845FAEB7B8EF44704F004066F900AB291DA74EA01C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 049DB02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049DB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E049E7D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E04A47016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x049db037
0x049db039
0x049db03b
0x049db040
0x04a2a60e
0x00000000
0x00000000
0x04a2a61d
0x049db04b
0x049db04e
0x04a2a627
0x04a2a634
0x00000000
0x00000000
0x04a2a641
0x04a2a653
0x04a2a643
0x04a2a64c
0x04a2a64c
0x04a2a65b
0x00000000
0x00000000
0x00000000
0x04a2a66c
0x049db057
0x049db057
0x049db057
0x049db046
0x049db046
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 9574ca27a9891d8e51b4044b9f1a1c213f1ca0f1fb96a22bffde3cbe28c8f2c7
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 1F015A322019849FE322CB5DCA88F7677ECEB85B54F0A40B1A919CBA55E728FD40D621

Uniqueness

Uniqueness Score: -1.00%

Function 04A91074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A91074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E04A9165E(__ebx, 0x4ab8ae4, (__edx -  *0x4ab8b04 >> 0x14) + (__edx -  *0x4ab8b04 >> 0x14), __edi, __ecx, (__edx -  *0x4ab8b04 >> 0x14) + (__edx -  *0x4ab8b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E04A8AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E049E7D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E04A7FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x04a91074
0x04a91080
0x04a91082
0x04a9108a
0x04a9108f
0x04a91093
0x04a910ab
0x04a910ab
0x04a910c3
0x04a910cf
0x04a910e1
0x04a910d1
0x04a910da
0x04a910da
0x04a910e9
0x04a910f5
0x04a910f5
0x04a910fe

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95589646946d8dcb2a487a0f469cc4ba896f6295c1d7c0ebb5725c60fe9fc852
Instruction ID: 13631fc8fc7fc44de4b3c8ae086fe7d19877bf39644a6482d5950c9f498ff943
Opcode Fuzzy Hash: 95589646946d8dcb2a487a0f469cc4ba896f6295c1d7c0ebb5725c60fe9fc852
Instruction Fuzzy Hash: BF012872504742AFEB11EB69D940B1A77E9AB84314F048529F88583291EE35FD40CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04A98ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04A98ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x4abd360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E049E7D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x04a98ed6
0x04a98ee5
0x04a98eed
0x04a98ef0
0x04a98efa
0x04a98f03
0x04a98f0c
0x04a98f15
0x04a98f24
0x04a98f27
0x04a98f31
0x04a98f43
0x04a98f33
0x04a98f3c
0x04a98f3c
0x04a98f4e
0x04a98f4f
0x04a98f51
0x04a98f56
0x04a98f69

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432260ca1355953cf7afe05d120f271efd1faebff801a145f55e46cab86e719c
Instruction ID: edda21bb2d91eb94cabc3bb3c83434b5b0f609556eedc24b9ea80f1049168598
Opcode Fuzzy Hash: 432260ca1355953cf7afe05d120f271efd1faebff801a145f55e46cab86e719c
Instruction Fuzzy Hash: BF110070A002099FDB04DFA9D545AAEB7F4FB08700F0482AAE518EB382E634A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A98A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04A98A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x4abd360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E049E7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04A0B640(E04A09AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04a98a62
0x04a98a71
0x04a98a79
0x04a98a82
0x04a98a85
0x04a98a89
0x04a98a8c
0x04a98a8f
0x04a98a92
0x04a98a95
0x04a98a9f
0x04a98ab1
0x04a98aa1
0x04a98aaa
0x04a98aaa
0x04a98abc
0x04a98abd
0x04a98abf
0x04a98ac4
0x04a98ada

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7812bd0b9ce000caa06f6ef92531c3d8d81a543c33c55ecc52f31885df1cc08
Instruction ID: 8d0066d2f912c543feb115ce277014b2b1c0617ad43c8d74fd089be9b1e4bb5b
Opcode Fuzzy Hash: a7812bd0b9ce000caa06f6ef92531c3d8d81a543c33c55ecc52f31885df1cc08
Instruction Fuzzy Hash: 4D011AB1A0021CAFDB00DFA9E9419EEB7F8EF49310F50406AF904E7391E634AD018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 049CDB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049CDB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E049CDB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E049CE7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L049CE8B0(__ecx, _t14, 0xfff);
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x049cdb64
0x049cdb66
0x049cdb6b
0x049cdbaa
0x049cdb71
0x049cdb76
0x049cdb7a
0x049cdba3
0x049cdb7c
0x049cdb87
0x049cdb8b
0x04a24fa1
0x04a24fb3
0x04a24fb8
0x049cdb91
0x049cdb96
0x049cdb98
0x049cdb98
0x049cdb8b
0x049cdb7a
0x049cdb9d
0x049cdba2

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: cfec4e9e56036597fd2dbb399436c87655b77aa2335fb4ab1038333589551578
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 59F0FC332415229FE7725A5588C0F37B6AA9FC1A60F15053DF1099B344C960AC0296E7

Uniqueness

Uniqueness Score: -1.00%

Function 049CB1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049CB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E049E7D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E049E7D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E04A47016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x049cb1e8
0x049cb1ea
0x049cb1f3
0x04a24a17
0x049cb1f9
0x049cb1f9
0x049cb1f9
0x049cb201
0x04a24a21
0x04a24a2e
0x00000000
0x00000000
0x04a24a3b
0x04a24a4d
0x04a24a3d
0x04a24a46
0x04a24a46
0x04a24a55
0x00000000
0x00000000
0x00000000
0x049cb20a
0x049cb20a
0x049cb20a
0x049cb20a

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: c81b252993855601c6e863e9da55863e7b97dc0838b45643271af0312314ecf5
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: A101D132200684EBE322975DE904F697BD9EF95754F4800B6F9148B6B1E679F840D316

Uniqueness

Uniqueness Score: -1.00%

Function 04A5FE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04A5FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x4abd360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E049E7D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x04a5fe96
0x04a5fe9e
0x04a5fea1
0x04a5fead
0x04a5feb3
0x04a5feb9
0x04a5fec3
0x04a5fed5
0x04a5fec5
0x04a5fece
0x04a5fece
0x04a5fee0
0x04a5fee1
0x04a5fee3
0x04a5fee8
0x04a5fefb

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172fa78b88f863aa71215efadc3e87660a5ee79de09316ed1a07dce1a7614266
Instruction ID: e8c0e69b873966c996c158ac7abf8edd6f4d1a6869a3b4aa9c9ed40da4ea6bc7
Opcode Fuzzy Hash: 172fa78b88f863aa71215efadc3e87660a5ee79de09316ed1a07dce1a7614266
Instruction Fuzzy Hash: B4018670A0020CEFCB14DFA8D542A6EB7F4FF04704F1441A9B904DB392E635E902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A98F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04A98F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x4abd360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E049E7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04a98f6a
0x04a98f79
0x04a98f81
0x04a98f84
0x04a98f8b
0x04a98f91
0x04a98f94
0x04a98f9e
0x04a98fb0
0x04a98fa0
0x04a98fa9
0x04a98fa9
0x04a98fbb
0x04a98fbc
0x04a98fbe
0x04a98fc3
0x04a98fd6

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a8975be0e24b458c4b3ce2da1e4774619330d9807b5692e0834573a589f4f1
Instruction ID: 6098ada3e24aa53ae4b2daee6a427b18de0fdc1ee3e409f26e5ec01cfa28e99f
Opcode Fuzzy Hash: 11a8975be0e24b458c4b3ce2da1e4774619330d9807b5692e0834573a589f4f1
Instruction Fuzzy Hash: 4E014974A0020C9FDB00EFA9D545AAEB7F4EF48300F504059B905EB381E774EE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04A8131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04A8131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x4abd360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E049E7D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04a8131b
0x04a8132a
0x04a81330
0x04a81336
0x04a8133e
0x04a81341
0x04a81344
0x04a8134f
0x04a81361
0x04a81351
0x04a8135a
0x04a8135a
0x04a8136c
0x04a8136d
0x04a8136f
0x04a81374
0x04a81387

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aaa36c7aa458bc8876d27c24b40de035614ef55d8c882ea765e7c1a31d0b704
Instruction ID: da18c6cb4b870e29ac84afc5bec6f0387d63612eb8173474021f0a4fc6c37edf
Opcode Fuzzy Hash: 1aaa36c7aa458bc8876d27c24b40de035614ef55d8c882ea765e7c1a31d0b704
Instruction Fuzzy Hash: A2013171A0120CAFDB44EFE9D545AAEB7F4FF48700F408069B945EB391E674EA01DB54

Uniqueness

Uniqueness Score: -1.00%

Function 04A81608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04A81608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x4abd360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E049E7D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x04a81608
0x04a81617
0x04a8161d
0x04a81625
0x04a81628
0x04a8162b
0x04a81636
0x04a81648
0x04a81638
0x04a81641
0x04a81641
0x04a81653
0x04a81654
0x04a81656
0x04a8165b
0x04a8166e

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb44acb03e1de080dc2d769357addafe0d1455cbe9b34d320d0c5691f335121
Instruction ID: a590a01ba683f0d42c00444c8ce006be7691806abb76c1e211a0c69d027c5aa2
Opcode Fuzzy Hash: afb44acb03e1de080dc2d769357addafe0d1455cbe9b34d320d0c5691f335121
Instruction Fuzzy Hash: B5F06271E04248EFDB04EFE9D505AAEB7F4FF14300F4440A9A905EB391E634E901CB94

Uniqueness

Uniqueness Score: -1.00%

Function 049EC577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049EC577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E049EC5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x49a11cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E04A988F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x049ec577
0x049ec57d
0x049ec581
0x049ec5b5
0x049ec5b9
0x049ec5ce
0x049ec5ce
0x049ec5ca
0x00000000
0x049ec5ca
0x049ec5c4
0x049ec5c8
0x00000000
0x00000000
0x00000000
0x049ec5ad
0x00000000
0x049ec5af

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a8a7ded32d712376be5d408eb2ee4aeeb90914b8f82e021d7da136ec567a5f
Instruction ID: 1224a738edbe1cb18f884f9560e1c8a4ae023ff3063049e6a566d9553047ec70
Opcode Fuzzy Hash: 87a8a7ded32d712376be5d408eb2ee4aeeb90914b8f82e021d7da136ec567a5f
Instruction Fuzzy Hash: DEF090B2A1D6909EE7339B168044F327BDC9B05774F548876D49587101CEA4F880C251

Uniqueness

Uniqueness Score: -1.00%

Function 04A98D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E04A98D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x4abd360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E049E7D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x04a98d34
0x04a98d43
0x04a98d4b
0x04a98d4e
0x04a98d52
0x04a98d5c
0x04a98d6e
0x04a98d5e
0x04a98d67
0x04a98d67
0x04a98d79
0x04a98d7a
0x04a98d7c
0x04a98d81
0x04a98d94

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fc6ffa9e3396605045384bc3578bc7332d556289efe6c49b639a64d169e79d
Instruction ID: 1224871d91ed3e2adecd4a9a251370a9158c85d76b05df843bb93de1cd00dda2
Opcode Fuzzy Hash: 09fc6ffa9e3396605045384bc3578bc7332d556289efe6c49b639a64d169e79d
Instruction Fuzzy Hash: 40F0B470E0460C9FDB04EFB8E541AAE77F4EF14300F5080A9E905EB291EA38ED00C754

Uniqueness

Uniqueness Score: -1.00%

Function 04A82073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04A82073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E04A7FD22(__ecx);
				_t19 =  *0x4ab849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4ab8748; // 0x0
					if(__eflags <= 0) {
						E04A81C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4ab8724 & 0x00000004;
							if(( *0x4ab8724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4ab8724; // 0x0
					return E04A78DF1(__ebx, 0xc0000374, 0x4ab5890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x04a82076
0x04a82078
0x04a8207d
0x04a82083
0x04a820a4
0x04a820aa
0x04a820ac
0x04a820b7
0x04a820ba
0x04a820bc
0x04a820c9
0x04a820c9
0x04a820d0
0x04a820d2
0x00000000
0x04a820d2
0x04a820be
0x04a820c3
0x04a820c5
0x04a820c7
0x00000000
0x00000000
0x04a820c7
0x04a820bc
0x04a820d4
0x04a82085
0x04a82085
0x04a820a3
0x04a820a3

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a976e217013334d74ad0958f38a238de089536320f29d6afaa02f07b7f10a200
Instruction ID: e2a3d6220d69fac1b0486b2ae53716af3f4b3e72a0f8ea954bf940b33eb8f632
Opcode Fuzzy Hash: a976e217013334d74ad0958f38a238de089536320f29d6afaa02f07b7f10a200
Instruction Fuzzy Hash: 19F0A0BB8151844AFF32BF2976013F22FA8D79611CB1954CDD89017202C53CAD83CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 04A0927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04A0927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E04A0FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E04A092C6(_t11, _t14);
				}
				return _t11;
			}

0x04a09295
0x04a09299
0x04a0929f
0x04a092aa
0x04a092ad
0x04a092ae
0x04a092af
0x04a092b0
0x04a092b4
0x04a092bb
0x04a092bb
0x04a092c5

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 5dd882c4174fd7490ab667bad05491b5778f72300915196f67516e7a0eea1d0c
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: A1E09B723405406BE7219F56DC84F57775DDFC6725F048079B5045F283C6E5ED0987A4

Uniqueness

Uniqueness Score: -1.00%

Function 04A98CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04A98CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x4abd360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E049E7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04a98ce5
0x04a98ced
0x04a98cf0
0x04a98cfb
0x04a98d0d
0x04a98cfd
0x04a98d06
0x04a98d06
0x04a98d18
0x04a98d19
0x04a98d1b
0x04a98d20
0x04a98d33

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b5fb120973bb554ba176fae8b2726a3155764ea0a3bd6d9a22ddf31d07a2de
Instruction ID: 0b96bd84f57843ffc2b9ec994e26fc2d591918f63e9316df371437782e31fc76
Opcode Fuzzy Hash: 33b5fb120973bb554ba176fae8b2726a3155764ea0a3bd6d9a22ddf31d07a2de
Instruction Fuzzy Hash: DBF08270A04208AFDB04EBA9E945EAE77F8EF59304F5441A9E915EB2D1EA38ED00C754

Uniqueness

Uniqueness Score: -1.00%

Function 049E746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E049E746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E049DEB70(__ecx, 0x4ab79a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E04A095D0();
							L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x049e746d
0x049e746d
0x049e746d
0x049e7471
0x049e7488
0x04a2f92d
0x049e748e
0x049e7491
0x049e7495
0x04a2f937
0x04a2f93a
0x04a2f94e
0x04a2f953
0x04a2f956
0x04a2f956
0x049e7495
0x00000000
0x049e7488
0x049e7473
0x049e7478
0x049e747d
0x049e7481
0x00000000
0x049e7481
0x049e747d
0x049e747a
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0537be16c80a81b1dc5dac88004c3f2a4cba2fcc3a6830464eeaf8b04ad70a
Instruction ID: f33a825fe3ef30e0182bb2acc74786e9419defea17779cc549d011ccdddcb88c
Opcode Fuzzy Hash: 1e0537be16c80a81b1dc5dac88004c3f2a4cba2fcc3a6830464eeaf8b04ad70a
Instruction Fuzzy Hash: 26F0B434600154BADF139BEAC540B797BB7AF44354F0445B5E891AB151F765B8009787

Uniqueness

Uniqueness Score: -1.00%

Function 049C4F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049C4F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E04A988F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E049EC5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x49a1030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x049c4f2e
0x049c4f34
0x049c4f38
0x04a20b85
0x04a20b85
0x04a20b89
0x04a20b9a
0x04a20b9a
0x04a20b9f
0x00000000
0x04a20b9f
0x04a20b94
0x04a20b98
0x00000000
0x00000000
0x00000000
0x04a20b98
0x049c4f3e
0x049c4f48
0x00000000
0x049c4f6e
0x00000000
0x049c4f70

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1177d805f2285a2c09bd3c9c63aaa770c666cb700c7ee102d07fa6331830c4
Instruction ID: 3c409d62526f7598b11e8d964f7f061464241e7e79fbbb9c2664f6ea97b39e3c
Opcode Fuzzy Hash: 1f1177d805f2285a2c09bd3c9c63aaa770c666cb700c7ee102d07fa6331830c4
Instruction Fuzzy Hash: E5F0E2325296B88FE771DB1CC344B23B7D5AB117B8F054474D50587920C734FC40D680

Uniqueness

Uniqueness Score: -1.00%

Function 04A98B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04A98B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x4abd360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E049E7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E04A0B640(E04A09AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04a98b67
0x04a98b6f
0x04a98b72
0x04a98b7d
0x04a98b8f
0x04a98b7f
0x04a98b88
0x04a98b88
0x04a98b9a
0x04a98b9b
0x04a98b9d
0x04a98ba2
0x04a98bb5

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d6e25937157c4b15d6960a213dd692cf4e1307280a760290f3274b75953a85
Instruction ID: 630462f54364dd833dbdc876409475238b869dc87b7cda887adaba7300030439
Opcode Fuzzy Hash: b0d6e25937157c4b15d6960a213dd692cf4e1307280a760290f3274b75953a85
Instruction Fuzzy Hash: FFF054B0A142589BDB00EBA4E605A6E73F4EB04304F440459AA059B2D1EB74E900C794

Uniqueness

Uniqueness Score: -1.00%

Function 049FA44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049FA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4ab7b9c; // 0x0
				_t15 = __ecx;
				_t16 = L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E04A0FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x049fa44b
0x049fa453
0x049fa472
0x049fa476
0x00000000
0x049fa493
0x049fa47a
0x049fa47f
0x049fa486
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391c84e883fa376c985cd027d0027e3c1815c1041ab4602d6745fddfb9bb1071
Instruction ID: 4a0303dfa7f944f51a08fc16dfec00973d3f59cd6f041bca534f8cecc8b1375d
Opcode Fuzzy Hash: 391c84e883fa376c985cd027d0027e3c1815c1041ab4602d6745fddfb9bb1071
Instruction Fuzzy Hash: FEE09272A01421ABD2225A1ABC00F66739DDBE8A55F094435F609D7250D668ED02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 049CF358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E049CF358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E049FF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L049E4620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x049cf35d
0x049cf361
0x049cf367
0x049cf372
0x049cf38c
0x049cf38c
0x049cf394

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 0abba6276f5df0aef52d18011ace5576d436acd983af8c74150829452f5c6720
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: ACE0D832A40118FBDB31A6D99D05FAABBADDB88FA0F000166B904DB194D560AD00C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 049DFF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049DFF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x49a11a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E04A988F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E049E0050(_t14);
				}
			}

0x049dff66
0x049dff6b
0x00000000
0x049dff8f
0x00000000
0x049dff8f

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be1515115414bc241007e6f9ef3fd1f918183f44df289ec61ece11964700f68
Instruction ID: 62bd79313262d91267dd60e885ab3f3d3a6d6d1adea7b646d5f9d1d22c7a9be9
Opcode Fuzzy Hash: 2be1515115414bc241007e6f9ef3fd1f918183f44df289ec61ece11964700f68
Instruction Fuzzy Hash: C4E0DFB06452049FEB39DF5AD142F2D37DC9B42729F19C43DE00A4B101C621F880C256

Uniqueness

Uniqueness Score: -1.00%

Function 04A541E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E04A541E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x4aa08f0);
				_t5 = E04A1D08C(__ebx, __edi, __esi);
				if( *0x4ab87ec == 0) {
					E049DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x4ab87ec == 0) {
						 *0x4ab87f0 = 0x4ab87ec;
						 *0x4ab87ec = 0x4ab87ec;
						 *0x4ab87e8 = 0x4ab87e4;
						 *0x4ab87e4 = 0x4ab87e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L04A54248();
				}
				return E04A1D0D1(_t5);
			}

0x04a541e8
0x04a541ea
0x04a541ef
0x04a541fb
0x04a54206
0x04a5420b
0x04a54216
0x04a5421d
0x04a54222
0x04a5422c
0x04a54231
0x04a54231
0x04a54236
0x04a5423d
0x04a5423d
0x04a54247

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe6ebdb31999d90c206a95046b024dff9929049cc4a29812a24fc9a62c3728b
Instruction ID: 0250c41b3e4c1f512c97dc9458b00921869cbc296fe9aa89e3c0027bf1c23456
Opcode Fuzzy Hash: 8fe6ebdb31999d90c206a95046b024dff9929049cc4a29812a24fc9a62c3728b
Instruction Fuzzy Hash: 63F01CB4812700DFEB60FF6EA60871836ACF75831EF10415D88009B6A6C73C68C2CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04A7D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A7D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L049CE8B0(__ecx, _a4, 0xfff);
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x04a7d38a
0x04a7d39b
0x04a7d3b1
0x00000000
0x04a7d3b6
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: cb0af37fa652d57a6b6b32bb38ae3640fac15a9f3c42f35d39cd88c293d0431d
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: C3E0C231280204BBEB325E44CC00FB97B26EF807A5F104035FE085A690C679BC91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 049FA185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049FA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x4ab67e4 >= 0xa) {
					if(_t5 < 0x4ab6800 || _t5 >= 0x4ab6900) {
						return L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E049E0010(0x4ab67e0, _t5);
				}
			}

0x049fa190
0x049fa1a6
0x049fa1c2
0x00000000
0x00000000
0x00000000
0x049fa192
0x049fa192
0x049fa19f
0x049fa19f

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9269c2460fbed719926535844a0d36a8fbdc520a998542d06d250e5e9bcd6c76
Instruction ID: aa5d034d2c60910e5a9bc9d4dcfbff4d321ee0bf5adba322edf83725a5d2e0de
Opcode Fuzzy Hash: 9269c2460fbed719926535844a0d36a8fbdc520a998542d06d250e5e9bcd6c76
Instruction Fuzzy Hash: E8D02B612200002AF61D1781AC24F31221AE7C4718F310C2CF24B0A5A1D950FCD0C38A

Uniqueness

Uniqueness Score: -1.00%

Function 049F16E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049F16E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E049F1710(0x4ab67e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L049E4620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x049f16e8
0x049f16ef
0x049f16f3
0x049f16fe
0x00000000
0x049f1700
0x049f170d
0x049f170d
0x049f16f2
0x049f16f2
0x049f16f2
0x049f16f2

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654feca68f7a767937d1590628e95739eb2a40e758d17b4ca0bb044141350602
Instruction ID: 9822aef026cad717c4b5fb2d2ce700ec30a44e9d2c07db2d048642b1405126f0
Opcode Fuzzy Hash: 654feca68f7a767937d1590628e95739eb2a40e758d17b4ca0bb044141350602
Instruction Fuzzy Hash: 0DD0A771110100D2FE2D5B119C05B142259DBC0B89F38007CF30B594C1DFA1FC92E5CC

Uniqueness

Uniqueness Score: -1.00%

Function 04A453CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A453CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E049DEB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x04a453ca
0x04a453ce
0x04a453d9
0x04a453de
0x04a453e1
0x04a453e1
0x04a453e6
0x04a453f3
0x00000000
0x04a453f8
0x04a453fb

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 5814f640c10bc2ccdc695184af220f2e44d41f34a5912072818f9dfdc3e481ca
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 97E08C32900B80AFCF12EB8AC660F9EB7F5FBC4B00F140454A0085F620C624BC00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 049F35A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049F35A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E049DEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x049f35a1
0x049f35a1
0x049f35a5
0x049f35ab
0x049f35ab
0x049f35b5
0x00000000
0x049f35c1
0x049f35b7

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: c170c5bc1bcec3e2be6c83ef3bd58dee3e88206525ec214c5e085a041931dbf6
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 0AD0A9315012809EEF21AB10CA1876C33B6BFC030CF5820758A4A0A862C33E7A0AD700

Uniqueness

Uniqueness Score: -1.00%

Function 049DAAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049DAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x049daab6
0x049daabb
0x04a2a442
0x00000000
0x04a2a448
0x04a2a454
0x04a2a454
0x049daac1
0x049daac1
0x049daac6
0x049daac6

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 4542a6692d4ad24a6b5188f13be2984a60d9ac9812ca711d2a27621017ae7aab
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 50D0E939352D90CFD716CF1DC554B1573A9BB44B44FD545A0E501CBB61E62CE954CA00

Uniqueness

Uniqueness Score: -1.00%

Function 04A4A537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A4A537(intOrPtr _a4, intOrPtr _a8) {

				return L049E8E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x04a4a553

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 69c11af58b562a4bc51e8b40f16af78a926001bf1d2ff3de4322df2ff71279fe
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 9EC01232080248BBCB12BE82CC00F267B2AEB94B60F008024BA080B5608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 049CDB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049CDB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L049E4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x049cdb4d
0x049cdb54
0x049cdb5f
0x049cdb56
0x049cdb56
0x049cdb5c
0x049cdb5c

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: fd52bdec38c9fde09a8a216bedea58481b8fcf80bae3d723ba7e86868f355f38
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 9AC08C30280A00AEEB221F20CD01B1036A4BB40F05F4400B06300DA0F0EB78E801EA00

Uniqueness

Uniqueness Score: -1.00%

Function 049CAD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049CAD30(intOrPtr _a4) {

				return L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x049cad49

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: a50ce2de5a07ca3c188a6b87fd7db0c8059a0f88a81da6ceedf3b1cdafe80388
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: B6C08C32080248BBC7126A86DD00F117B29E7D0B60F000020B6040A6618932E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 049F36CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049F36CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L049E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x049f36d2
0x049f36e8
0x049f36d4
0x049f36e5
0x049f36e5

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: f9f0229488bd103c7fe1274a896af8b53bd207da859759b39dc6bff34771acea
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: B8C09B75155440FBEB265F30CD51F257258F744E65F6407747321495F0D56DBC40D608

Uniqueness

Uniqueness Score: -1.00%

Function 049D76E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049D76E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L049E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x049d76e4
0x00000000
0x049d76f8
0x049d76fd

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 57c711cb6c5286f21eb03ae194dc6708edbc4b3f9c76525a7cb3d8776e439478
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 3BC08C701411805AEB2A6B88CE20B307658BB48708F8809FCAA01094A1D369B802C209

Uniqueness

Uniqueness Score: -1.00%

Function 049E3A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049E3A1C(intOrPtr _a4) {
				void* _t5;

				return L049E4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x049e3a35

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 8e1f9b7476eaa99806832d321d75f25a3223afaedb032798581623b6d28bd356
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 0DC04C32180648BBDB126E46DD01F157B69E794B60F154021B6040A5618576ED61D99C

Uniqueness

Uniqueness Score: -1.00%

Function 049E7D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049E7D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x049e7d56
0x049e7d5b
0x049e7d60
0x049e7d5d
0x049e7d5d
0x049e7d5d

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: b1960aacd16dea494abc69bf90b0427fd5a559aa735e5574ca19e7ddeb169981
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: E8B09234301941CFCF16DF19C080B2533E8BB44A40B8400E0E400CBA20D229E8408900

Uniqueness

Uniqueness Score: -1.00%

Function 049F2ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E049F2ACB() {
				void* _t5;

				return E049DEB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x049f2adc

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: cfdd47455d2f956cab59490dde43adcdb65dd8b3426b967a189dd5b876da8a41
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 6CB01232C10940CFCF02FF40C610B197331FF40750F0584A090012B930C22CBC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04A5FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04A5FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E04A0CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E04A55720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E04A55720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x04a5fdda
0x04a5fde2
0x04a5fde5
0x04a5fdec
0x04a5fdfa
0x04a5fdff
0x04a5fe0a
0x04a5fe0f
0x04a5fe17
0x04a5fe1e
0x04a5fe19
0x04a5fe19
0x04a5fe19
0x04a5fe20
0x04a5fe21
0x04a5fe22
0x04a5fe25
0x04a5fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04A5FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04A5FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04A5FE2B

Memory Dump Source

Source File: 0000000A.00000002.481575790.00000000049A0000.00000040.00000001.sdmp, Offset: 049A0000, based on PE: true

Associated: 0000000A.00000002.482132680.0000000004ABB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.482167165.0000000004ABF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 91beee2d500e75e08af51cbf62eedc8e4e7ee6f2691727f8cd573e3269268cdb
Instruction ID: e42b4a156f8457ee7e9560d7afacb33308b95ad7a561d2e4bbd37e591cfb9d60
Opcode Fuzzy Hash: 91beee2d500e75e08af51cbf62eedc8e4e7ee6f2691727f8cd573e3269268cdb
Instruction Fuzzy Hash: CDF02B72600201BFEA251B45DE06F63BF6AEB84730F244354FA68565E1EA72F87097F4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO#560.zip.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers