Play interactive tour

Edit tour

Analysis Report Inquiry_10_05_2021,pdf.exe

Overview

General Information

Sample Name:	Inquiry_10_05_2021,pdf.exe
Analysis ID:	411852
MD5:	d394a8c0a37bcdaf432b2882714c6eba
SHA1:	52d386445e50600a920f16692bbf30829d08932c
SHA256:	3f4dc309be69548972299cb0517c884bcb5a472fbf9693ff3d07776c9464af1c
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

Inquiry_10_05_2021,pdf.exe (PID: 1560 cmdline: 'C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe' MD5: D394A8C0A37BCDAF432B2882714C6EBA)

Inquiry_10_05_2021,pdf.exe (PID: 576 cmdline: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe MD5: D394A8C0A37BCDAF432B2882714C6EBA)

explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

autochk.exe (PID: 2156 cmdline: C:\Windows\SysWOW64\autochk.exe MD5: 34236DB574405291498BCD13D20C42EB)

cmmon32.exe (PID: 4772 cmdline: C:\Windows\SysWOW64\cmmon32.exe MD5: 2879B30A164B9F7671B5E6B2E9F8DFDA)

cmd.exe (PID: 5068 cmdline: /c del 'C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.werealestatephotography.com/hw6d/"], "decoy": ["medicare101now.com", "danahillathletics.com", "realjobexpert.com", "boulderhalle-hamburg.com", "idoweddinghair.com", "awdcompanies.com", "thevillaflora.com", "neutrasystems.com", "allwest-originals.com", "designtehengsg.com", "thenewyorker.computer", "ladybugtubs.com", "silina-beauty24.com", "mifangtu.com", "fashionbranddeveloper.com", "istanbulhookah.com", "askyoyo.com", "osaka-computer.net", "conegenie.com", "agteless.com", "carsoncredittx.com", "wellalytics.com", "onjulitrading.com", "thelocallawnmen.com", "loanascustomboutique.com", "ohcaftanmycaftan.com", "ardor-fitness.com", "benzinhayvancilik.com", "apthaiproperty.com", "maxim.technology", "dfch18.com", "davaoaffordablecondo.com", "sueshemp.com", "missmaltese.com", "lakecountrydems.com", "lastminuteminister.com", "sofiascelebrations.com", "socialaspecthouston.com", "rechnung.pro", "kathyscrabhouse.com", "themusasoficial.com", "reversemortgageloanmiami.com", "vrventurebsp.com", "whatalode.com", "xh03.net", "qiqihao.site", "specstrii.com", "organicfarmteam.com", "codebinnovations.net", "kizunaservice.com", "lboclkchain.com", "frorool.com", "dpok.network", "desafogados.com", "vestblue.net", "forguyshere.com", "recordprosperity.info", "theballoonbirds.com", "adityabirla-loan.com", "midgex.info", "qishuxia.com", "panopticop.com", "gd-kangda.com", "hotelbrainclub.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x29758:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x29ae2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x357f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x352e1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x358f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x35a6f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2a4fa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x3455c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2b272:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x3a8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x3b98a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x37819:$sqlite3step: 68 34 1C 7B E1 0x3792c:$sqlite3step: 68 34 1C 7B E1 0x37848:$sqlite3text: 68 38 2A 90 C5 0x3796d:$sqlite3text: 68 38 2A 90 C5 0x3785b:$sqlite3blob: 68 53 D8 7F 8C 0x37983:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x26428:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x267b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x4e448:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x4e7d2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x324c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x5a4e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x31fb1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x59fd1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x325c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x5a5e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x3273f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x5a75f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x271ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x4f1ea:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x3122c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x5924c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x27f42:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x4ff62:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x375b7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x5f5d7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x3865a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x344e9:$sqlite3step: 68 34 1C 7B E1 0x345fc:$sqlite3step: 68 34 1C 7B E1 0x5c509:$sqlite3step: 68 34 1C 7B E1 0x5c61c:$sqlite3step: 68 34 1C 7B E1 0x34518:$sqlite3text: 68 38 2A 90 C5 0x3463d:$sqlite3text: 68 38 2A 90 C5 0x5c538:$sqlite3text: 68 38 2A 90 C5 0x5c65d:$sqlite3text: 68 38 2A 90 C5 0x3452b:$sqlite3blob: 68 53 D8 7F 8C 0x34653:$sqlite3blob: 68 53 D8 7F 8C 0x5c54b:$sqlite3blob: 68 53 D8 7F 8C 0x5c673:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9468:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x97f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15505:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14ff1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15607:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1577f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa20a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1426c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xaf82:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a5f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b69a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17529:$sqlite3step: 68 34 1C 7B E1 0x1763c:$sqlite3step: 68 34 1C 7B E1 0x17558:$sqlite3text: 68 38 2A 90 C5 0x1767d:$sqlite3text: 68 38 2A 90 C5 0x1756b:$sqlite3blob: 68 53 D8 7F 8C 0x17693:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x53510:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x5389a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x30ee1:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x30fe3:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x3115b:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x542b2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x5e314:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x5502a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x35fd3:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x37076:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x32f05:$sqlite3step: 68 34 1C 7B E1 0x33018:$sqlite3step: 68 34 1C 7B E1 0x32f34:$sqlite3text: 68 38 2A 90 C5 0x33059:$sqlite3text: 68 38 2A 90 C5 0x32f47:$sqlite3blob: 68 53 D8 7F 8C 0x3306f:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166a9:$sqlite3step: 68 34 1C 7B E1 0x167bc:$sqlite3step: 68 34 1C 7B E1 0x166d8:$sqlite3text: 68 38 2A 90 C5 0x167fd:$sqlite3text: 68 38 2A 90 C5 0x166eb:$sqlite3blob: 68 53 D8 7F 8C 0x16813:$sqlite3blob: 68 53 D8 7F 8C
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158a9:$sqlite3step: 68 34 1C 7B E1 0x159bc:$sqlite3step: 68 34 1C 7B E1 0x158d8:$sqlite3text: 68 38 2A 90 C5 0x159fd:$sqlite3text: 68 38 2A 90 C5 0x158eb:$sqlite3blob: 68 53 D8 7F 8C 0x15a13:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.werealestatephotography.com/hw6d/"], "decoy": ["medicare101now.com", "danahillathletics.com", "realjobexpert.com", "boulderhalle-hamburg.com", "idoweddinghair.com", "awdcompanies.com", "thevillaflora.com", "neutrasystems.com", "allwest-originals.com", "designtehengsg.com", "thenewyorker.computer", "ladybugtubs.com", "silina-beauty24.com", "mifangtu.com", "fashionbranddeveloper.com", "istanbulhookah.com", "askyoyo.com", "osaka-computer.net", "conegenie.com", "agteless.com", "carsoncredittx.com", "wellalytics.com", "onjulitrading.com", "thelocallawnmen.com", "loanascustomboutique.com", "ohcaftanmycaftan.com", "ardor-fitness.com", "benzinhayvancilik.com", "apthaiproperty.com", "maxim.technology", "dfch18.com", "davaoaffordablecondo.com", "sueshemp.com", "missmaltese.com", "lakecountrydems.com", "lastminuteminister.com", "sofiascelebrations.com", "socialaspecthouston.com", "rechnung.pro", "kathyscrabhouse.com", "themusasoficial.com", "reversemortgageloanmiami.com", "vrventurebsp.com", "whatalode.com", "xh03.net", "qiqihao.site", "specstrii.com", "organicfarmteam.com", "codebinnovations.net", "kizunaservice.com", "lboclkchain.com", "frorool.com", "dpok.network", "desafogados.com", "vestblue.net", "forguyshere.com", "recordprosperity.info", "theballoonbirds.com", "adityabirla-loan.com", "midgex.info", "qishuxia.com", "panopticop.com", "gd-kangda.com", "hotelbrainclub.com"]}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Metadefender: Detection: 32%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	ReversingLabs: Detection: 53%

Multi AV Scanner detection for submitted file

Show sources

Source: Inquiry_10_05_2021,pdf.exe	Metadefender: Detection: 32%			Perma Link
Source: Inquiry_10_05_2021,pdf.exe	ReversingLabs: Detection: 53%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: Inquiry_10_05_2021,pdf.exe

Joe Sandbox ML: detected

Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: Inquiry_10_05_2021,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Inquiry_10_05_2021,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 0000000E.00000000.353153104.0000000009B40000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: Inquiry_10_05_2021,pdf.exe, 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, cmmon32.exe, 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Inquiry_10_05_2021,pdf.exe, cmmon32.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 0000000E.00000000.353153104.0000000009B40000.00000002.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.werealestatephotography.com/hw6d/

Source: unknown

DNS traffic detected: queries for: www.qiqihao.site

Source: explorer.exe, 0000000E.00000002.475689345.0000000004DF3000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.327976941.0000000002814000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_004181B0 NtCreateFile,	13_2_004181B0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00418260 NtReadFile,	13_2_00418260
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_004182E0 NtClose,	13_2_004182E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00418390 NtAllocateVirtualMemory,	13_2_00418390
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_004181AA NtCreateFile,	13_2_004181AA
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_004182DA NtClose,	13_2_004182DA
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309910 NtAdjustPrivilegesToken,LdrInitializeThunk,	13_2_01309910
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013099A0 NtCreateSection,LdrInitializeThunk,	13_2_013099A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309860 NtQuerySystemInformation,LdrInitializeThunk,	13_2_01309860
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309840 NtDelayExecution,LdrInitializeThunk,	13_2_01309840
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013098F0 NtReadVirtualMemory,LdrInitializeThunk,	13_2_013098F0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309A20 NtResumeThread,LdrInitializeThunk,	13_2_01309A20
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309A00 NtProtectVirtualMemory,LdrInitializeThunk,	13_2_01309A00
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309A50 NtCreateFile,LdrInitializeThunk,	13_2_01309A50
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309540 NtReadFile,LdrInitializeThunk,	13_2_01309540
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013095D0 NtClose,LdrInitializeThunk,	13_2_013095D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309710 NtQueryInformationToken,LdrInitializeThunk,	13_2_01309710
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013097A0 NtUnmapViewOfSection,LdrInitializeThunk,	13_2_013097A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309780 NtMapViewOfSection,LdrInitializeThunk,	13_2_01309780
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309FE0 NtCreateMutant,LdrInitializeThunk,	13_2_01309FE0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309660 NtAllocateVirtualMemory,LdrInitializeThunk,	13_2_01309660
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013096E0 NtFreeVirtualMemory,LdrInitializeThunk,	13_2_013096E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309950 NtQueueApcThread,	13_2_01309950
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013099D0 NtCreateProcessEx,	13_2_013099D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309820 NtEnumerateKey,	13_2_01309820
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0130B040 NtSuspendThread,	13_2_0130B040
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013098A0 NtWriteVirtualMemory,	13_2_013098A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309B00 NtSetValueKey,	13_2_01309B00
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0130A3B0 NtGetContextThread,	13_2_0130A3B0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309A10 NtQuerySection,	13_2_01309A10
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309A80 NtOpenDirectoryObject,	13_2_01309A80
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0130AD30 NtSetContextThread,	13_2_0130AD30
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309520 NtWaitForSingleObject,	13_2_01309520
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309560 NtWriteFile,	13_2_01309560
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013095F0 NtQueryInformationFile,	13_2_013095F0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309730 NtQueryVirtualMemory,	13_2_01309730
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0130A710 NtOpenProcessToken,	13_2_0130A710
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0130A770 NtOpenThread,	13_2_0130A770
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309770 NtSetInformationFile,	13_2_01309770
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309760 NtOpenProcess,	13_2_01309760
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309610 NtEnumerateValueKey,	13_2_01309610
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309670 NtQueryInformationProcess,	13_2_01309670
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01309650 NtQueryValueKey,	13_2_01309650
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013096D0 NtCreateKey,	13_2_013096D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239910 NtAdjustPrivilegesToken,LdrInitializeThunk,	21_2_05239910
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239540 NtReadFile,LdrInitializeThunk,	21_2_05239540
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052399A0 NtCreateSection,LdrInitializeThunk,	21_2_052399A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052395D0 NtClose,LdrInitializeThunk,	21_2_052395D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239860 NtQuerySystemInformation,LdrInitializeThunk,	21_2_05239860
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239840 NtDelayExecution,LdrInitializeThunk,	21_2_05239840
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239710 NtQueryInformationToken,LdrInitializeThunk,	21_2_05239710
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239780 NtMapViewOfSection,LdrInitializeThunk,	21_2_05239780
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239FE0 NtCreateMutant,LdrInitializeThunk,	21_2_05239FE0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239660 NtAllocateVirtualMemory,LdrInitializeThunk,	21_2_05239660
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239A50 NtCreateFile,LdrInitializeThunk,	21_2_05239A50
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239650 NtQueryValueKey,LdrInitializeThunk,	21_2_05239650
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052396E0 NtFreeVirtualMemory,LdrInitializeThunk,	21_2_052396E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052396D0 NtCreateKey,LdrInitializeThunk,	21_2_052396D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239520 NtWaitForSingleObject,	21_2_05239520
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0523AD30 NtSetContextThread,	21_2_0523AD30
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239560 NtWriteFile,	21_2_05239560
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239950 NtQueueApcThread,	21_2_05239950
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052395F0 NtQueryInformationFile,	21_2_052395F0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052399D0 NtCreateProcessEx,	21_2_052399D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239820 NtEnumerateKey,	21_2_05239820
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0523B040 NtSuspendThread,	21_2_0523B040
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052398A0 NtWriteVirtualMemory,	21_2_052398A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052398F0 NtReadVirtualMemory,	21_2_052398F0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239730 NtQueryVirtualMemory,	21_2_05239730
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239B00 NtSetValueKey,	21_2_05239B00
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0523A710 NtOpenProcessToken,	21_2_0523A710
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239760 NtOpenProcess,	21_2_05239760
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239770 NtSetInformationFile,	21_2_05239770
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0523A770 NtOpenThread,	21_2_0523A770
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052397A0 NtUnmapViewOfSection,	21_2_052397A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0523A3B0 NtGetContextThread,	21_2_0523A3B0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239A20 NtResumeThread,	21_2_05239A20
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239A00 NtProtectVirtualMemory,	21_2_05239A00
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239610 NtEnumerateValueKey,	21_2_05239610
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239A10 NtQuerySection,	21_2_05239A10
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239670 NtQueryInformationProcess,	21_2_05239670
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05239A80 NtOpenDirectoryObject,	21_2_05239A80
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03288390 NtAllocateVirtualMemory,	21_2_03288390
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03288260 NtReadFile,	21_2_03288260
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_032882E0 NtClose,	21_2_032882E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_032881B0 NtCreateFile,	21_2_032881B0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_032882DA NtClose,	21_2_032882DA
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_032881AA NtCreateFile,	21_2_032881AA

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Code function: 0_2_00C7E2AA	0_2_00C7E2AA
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Code function: 0_2_00C7E2B0	0_2_00C7E2B0
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Code function: 0_2_00C7C30C	0_2_00C7C30C
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Code function: 0_2_075E1388	0_2_075E1388
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00401030	13_2_00401030
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00408C4B	13_2_00408C4B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00408C50	13_2_00408C50
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041BC56	13_2_0041BC56
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041B496	13_2_0041B496
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041CD31	13_2_0041CD31
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00402D87	13_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00402D90	13_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00402FB0	13_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E4120	13_2_012E4120
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CF900	13_2_012CF900
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381002	13_2_01381002
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013920A8	13_2_013920A8
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DB090	13_2_012DB090
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013928EC	13_2_013928EC
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01392B28	13_2_01392B28
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FEBB0	13_2_012FEBB0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138DBD2	13_2_0138DBD2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013922AE	13_2_013922AE
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C0D20	13_2_012C0D20
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01392D07	13_2_01392D07
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01391D55	13_2_01391D55
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2581	13_2_012F2581
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DD5E0	13_2_012DD5E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013925DD	13_2_013925DD
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D841F	13_2_012D841F
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138D466	13_2_0138D466
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01391FF1	13_2_01391FF1
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E6E30	13_2_012E6E30
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138D616	13_2_0138D616
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01392EF7	13_2_01392EF7
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05214120	21_2_05214120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FF900	21_2_051FF900
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C2D07	21_2_052C2D07
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F0D20	21_2_051F0D20
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C1D55	21_2_052C1D55
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222581	21_2_05222581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520D5E0	21_2_0520D5E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C25DD	21_2_052C25DD
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1002	21_2_052B1002
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520841F	21_2_0520841F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C20A8	21_2_052C20A8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520B090	21_2_0520B090
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C28EC	21_2_052C28EC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C2B28	21_2_052C2B28
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522EBB0	21_2_0522EBB0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C1FF1	21_2_052C1FF1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052BDBD2	21_2_052BDBD2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05216E30	21_2_05216E30
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C22AE	21_2_052C22AE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C2EF7	21_2_052C2EF7
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03272FB0	21_2_03272FB0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0328CD31	21_2_0328CD31
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03272D87	21_2_03272D87
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03272D90	21_2_03272D90
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03278C4B	21_2_03278C4B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03278C50	21_2_03278C50
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0328B496	21_2_0328B496

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: String function: 012CB150 appears 35 times
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: String function: 051FB150 appears 35 times

Source: Inquiry_10_05_2021,pdf.exe	Binary or memory string: OriginalFilename vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDggcokarg.dll" vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333927705.0000000006F00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe, 00000000.00000003.324453096.00000000073E1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameIrqoouoq.exe< vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe	Binary or memory string: OriginalFilename vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe, 0000000D.00000002.393459524.000000000154F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Inquiry_10_05_2021,pdf.exe
Source: Inquiry_10_05_2021,pdf.exe	Binary or memory string: OriginalFilenameIrqoouoq.exe< vs Inquiry_10_05_2021,pdf.exe

Source: Inquiry_10_05_2021,pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: Inquiry_10_05_2021,pdf.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Inquiry_10_05_2021,pdf.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/3@3/0

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry_10_05_2021,pdf.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3776:120:WilError_01

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

File created: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Jump to behavior

Source: Inquiry_10_05_2021,pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Inquiry_10_05_2021,pdf.exe	Metadefender: Detection: 32%
Source: Inquiry_10_05_2021,pdf.exe	ReversingLabs: Detection: 53%

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

File read: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe 'C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe'
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process created: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autochk.exe C:\Windows\SysWOW64\autochk.exe
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Process created: C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmmon32.exe
Source: C:\Windows\SysWOW64\cmmon32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process created: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Process created: C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmmon32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Inquiry_10_05_2021,pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Inquiry_10_05_2021,pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 0000000E.00000000.353153104.0000000009B40000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: Inquiry_10_05_2021,pdf.exe, 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, cmmon32.exe, 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Inquiry_10_05_2021,pdf.exe, cmmon32.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 0000000E.00000000.353153104.0000000009B40000.00000002.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: Inquiry_10_05_2021,pdf.exe.0.dr, u0006u001du000f/u0007.cs	.Net Code: \x0E\x1D\x0F System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Inquiry_10_05_2021,pdf.exe.4e0000.0.unpack, u0006u001du000f/u0007.cs	.Net Code: \x0E\x1D\x0F System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Inquiry_10_05_2021,pdf.exe.4e0000.0.unpack, u0006u001du000f/u0007.cs	.Net Code: \x0E\x1D\x0F System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.Inquiry_10_05_2021,pdf.exe.7a0000.0.unpack, u0006u001du000f/u0007.cs	.Net Code: \x0E\x1D\x0F System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.Inquiry_10_05_2021,pdf.exe.7a0000.1.unpack, u0006u001du000f/u0007.cs	.Net Code: \x0E\x1D\x0F System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_004153DD push ebp; ret	13_2_004153E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041B3F2 push eax; ret	13_2_0041B3F8
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041B3FB push eax; ret	13_2_0041B462
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041B3A5 push eax; ret	13_2_0041B3F8
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0041B45C push eax; ret	13_2_0041B462
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00417DC3 pushad ; ret	13_2_00417DC4
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00415E10 push edi; ret	13_2_00415E31
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_00414F69 push edx; ret	13_2_00414F6A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0131D0D1 push ecx; ret	13_2_0131D0E4
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0524D0D1 push ecx; ret	21_2_0524D0E4
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0328B3A5 push eax; ret	21_2_0328B3F8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0328B3FB push eax; ret	21_2_0328B462
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0328B3F2 push eax; ret	21_2_0328B3F8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_032853DD push ebp; ret	21_2_032853E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03284F69 push edx; ret	21_2_03284F6A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03285E10 push edi; ret	21_2_03285E31
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_03287DC3 pushad ; ret	21_2_03287DC4
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0328B45C push eax; ret	21_2_0328B462

Source: initial sample	Static PE information: section name: .text entropy: 7.99403499414
Source: initial sample	Static PE information: section name: .text entropy: 7.99403499414

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

File created: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmmon32.exe	RDTSC instruction interceptor: First address: 00000000032785E4 second address: 00000000032785EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmmon32.exe	RDTSC instruction interceptor: First address: 000000000327896E second address: 0000000003278974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Code function: 13_2_004088A0 rdtsc

13_2_004088A0

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe TID: 6024

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmmon32.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 0000000E.00000000.351910419.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000E.00000000.351910419.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 0000000E.00000000.351592629.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.351314090.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000E.00000002.476669997.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 0000000E.00000000.351910419.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 0000000E.00000000.351910419.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000E.00000002.476711938.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 0000000E.00000000.351314090.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000E.00000000.351314090.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000000E.00000002.476781580.00000000056A1000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll JPE
Source: explorer.exe, 0000000E.00000000.351314090.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Code function: 13_2_004088A0 rdtsc

13_2_004088A0

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Code function: 13_2_00409B10 LdrLoadDll,

13_2_00409B10

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E4120 mov eax, dword ptr fs:[00000030h]	13_2_012E4120
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E4120 mov eax, dword ptr fs:[00000030h]	13_2_012E4120
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E4120 mov eax, dword ptr fs:[00000030h]	13_2_012E4120
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E4120 mov eax, dword ptr fs:[00000030h]	13_2_012E4120
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E4120 mov ecx, dword ptr fs:[00000030h]	13_2_012E4120
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F513A mov eax, dword ptr fs:[00000030h]	13_2_012F513A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F513A mov eax, dword ptr fs:[00000030h]	13_2_012F513A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9100 mov eax, dword ptr fs:[00000030h]	13_2_012C9100
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9100 mov eax, dword ptr fs:[00000030h]	13_2_012C9100
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9100 mov eax, dword ptr fs:[00000030h]	13_2_012C9100
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CC962 mov eax, dword ptr fs:[00000030h]	13_2_012CC962
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CB171 mov eax, dword ptr fs:[00000030h]	13_2_012CB171
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CB171 mov eax, dword ptr fs:[00000030h]	13_2_012CB171
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EB944 mov eax, dword ptr fs:[00000030h]	13_2_012EB944
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EB944 mov eax, dword ptr fs:[00000030h]	13_2_012EB944
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013451BE mov eax, dword ptr fs:[00000030h]	13_2_013451BE
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013451BE mov eax, dword ptr fs:[00000030h]	13_2_013451BE
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013451BE mov eax, dword ptr fs:[00000030h]	13_2_013451BE
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013451BE mov eax, dword ptr fs:[00000030h]	13_2_013451BE
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F61A0 mov eax, dword ptr fs:[00000030h]	13_2_012F61A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F61A0 mov eax, dword ptr fs:[00000030h]	13_2_012F61A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013469A6 mov eax, dword ptr fs:[00000030h]	13_2_013469A6
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FA185 mov eax, dword ptr fs:[00000030h]	13_2_012FA185
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EC182 mov eax, dword ptr fs:[00000030h]	13_2_012EC182
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2990 mov eax, dword ptr fs:[00000030h]	13_2_012F2990
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CB1E1 mov eax, dword ptr fs:[00000030h]	13_2_012CB1E1
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CB1E1 mov eax, dword ptr fs:[00000030h]	13_2_012CB1E1
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CB1E1 mov eax, dword ptr fs:[00000030h]	13_2_012CB1E1
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013541E8 mov eax, dword ptr fs:[00000030h]	13_2_013541E8
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F002D mov eax, dword ptr fs:[00000030h]	13_2_012F002D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F002D mov eax, dword ptr fs:[00000030h]	13_2_012F002D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F002D mov eax, dword ptr fs:[00000030h]	13_2_012F002D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F002D mov eax, dword ptr fs:[00000030h]	13_2_012F002D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F002D mov eax, dword ptr fs:[00000030h]	13_2_012F002D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DB02A mov eax, dword ptr fs:[00000030h]	13_2_012DB02A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DB02A mov eax, dword ptr fs:[00000030h]	13_2_012DB02A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DB02A mov eax, dword ptr fs:[00000030h]	13_2_012DB02A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DB02A mov eax, dword ptr fs:[00000030h]	13_2_012DB02A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01347016 mov eax, dword ptr fs:[00000030h]	13_2_01347016
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01347016 mov eax, dword ptr fs:[00000030h]	13_2_01347016
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01347016 mov eax, dword ptr fs:[00000030h]	13_2_01347016
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01394015 mov eax, dword ptr fs:[00000030h]	13_2_01394015
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01394015 mov eax, dword ptr fs:[00000030h]	13_2_01394015
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01382073 mov eax, dword ptr fs:[00000030h]	13_2_01382073
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01391074 mov eax, dword ptr fs:[00000030h]	13_2_01391074
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E0050 mov eax, dword ptr fs:[00000030h]	13_2_012E0050
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E0050 mov eax, dword ptr fs:[00000030h]	13_2_012E0050
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0 mov eax, dword ptr fs:[00000030h]	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0 mov eax, dword ptr fs:[00000030h]	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0 mov eax, dword ptr fs:[00000030h]	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0 mov eax, dword ptr fs:[00000030h]	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0 mov eax, dword ptr fs:[00000030h]	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F20A0 mov eax, dword ptr fs:[00000030h]	13_2_012F20A0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FF0BF mov ecx, dword ptr fs:[00000030h]	13_2_012FF0BF
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FF0BF mov eax, dword ptr fs:[00000030h]	13_2_012FF0BF
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FF0BF mov eax, dword ptr fs:[00000030h]	13_2_012FF0BF
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013090AF mov eax, dword ptr fs:[00000030h]	13_2_013090AF
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9080 mov eax, dword ptr fs:[00000030h]	13_2_012C9080
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01343884 mov eax, dword ptr fs:[00000030h]	13_2_01343884
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01343884 mov eax, dword ptr fs:[00000030h]	13_2_01343884
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C58EC mov eax, dword ptr fs:[00000030h]	13_2_012C58EC
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135B8D0 mov eax, dword ptr fs:[00000030h]	13_2_0135B8D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135B8D0 mov ecx, dword ptr fs:[00000030h]	13_2_0135B8D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135B8D0 mov eax, dword ptr fs:[00000030h]	13_2_0135B8D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135B8D0 mov eax, dword ptr fs:[00000030h]	13_2_0135B8D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135B8D0 mov eax, dword ptr fs:[00000030h]	13_2_0135B8D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135B8D0 mov eax, dword ptr fs:[00000030h]	13_2_0135B8D0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138131B mov eax, dword ptr fs:[00000030h]	13_2_0138131B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CDB60 mov ecx, dword ptr fs:[00000030h]	13_2_012CDB60
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F3B7A mov eax, dword ptr fs:[00000030h]	13_2_012F3B7A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F3B7A mov eax, dword ptr fs:[00000030h]	13_2_012F3B7A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01398B58 mov eax, dword ptr fs:[00000030h]	13_2_01398B58
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CDB40 mov eax, dword ptr fs:[00000030h]	13_2_012CDB40
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CF358 mov eax, dword ptr fs:[00000030h]	13_2_012CF358
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F4BAD mov eax, dword ptr fs:[00000030h]	13_2_012F4BAD
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F4BAD mov eax, dword ptr fs:[00000030h]	13_2_012F4BAD
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F4BAD mov eax, dword ptr fs:[00000030h]	13_2_012F4BAD
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01395BA5 mov eax, dword ptr fs:[00000030h]	13_2_01395BA5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D1B8F mov eax, dword ptr fs:[00000030h]	13_2_012D1B8F
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D1B8F mov eax, dword ptr fs:[00000030h]	13_2_012D1B8F
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138138A mov eax, dword ptr fs:[00000030h]	13_2_0138138A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0137D380 mov ecx, dword ptr fs:[00000030h]	13_2_0137D380
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2397 mov eax, dword ptr fs:[00000030h]	13_2_012F2397
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FB390 mov eax, dword ptr fs:[00000030h]	13_2_012FB390
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EDBE9 mov eax, dword ptr fs:[00000030h]	13_2_012EDBE9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F03E2 mov eax, dword ptr fs:[00000030h]	13_2_012F03E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F03E2 mov eax, dword ptr fs:[00000030h]	13_2_012F03E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F03E2 mov eax, dword ptr fs:[00000030h]	13_2_012F03E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F03E2 mov eax, dword ptr fs:[00000030h]	13_2_012F03E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F03E2 mov eax, dword ptr fs:[00000030h]	13_2_012F03E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F03E2 mov eax, dword ptr fs:[00000030h]	13_2_012F03E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013453CA mov eax, dword ptr fs:[00000030h]	13_2_013453CA
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013453CA mov eax, dword ptr fs:[00000030h]	13_2_013453CA
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01304A2C mov eax, dword ptr fs:[00000030h]	13_2_01304A2C
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01304A2C mov eax, dword ptr fs:[00000030h]	13_2_01304A2C
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D8A0A mov eax, dword ptr fs:[00000030h]	13_2_012D8A0A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138AA16 mov eax, dword ptr fs:[00000030h]	13_2_0138AA16
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138AA16 mov eax, dword ptr fs:[00000030h]	13_2_0138AA16
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E3A1C mov eax, dword ptr fs:[00000030h]	13_2_012E3A1C
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CAA16 mov eax, dword ptr fs:[00000030h]	13_2_012CAA16
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CAA16 mov eax, dword ptr fs:[00000030h]	13_2_012CAA16
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C5210 mov eax, dword ptr fs:[00000030h]	13_2_012C5210
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C5210 mov ecx, dword ptr fs:[00000030h]	13_2_012C5210
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C5210 mov eax, dword ptr fs:[00000030h]	13_2_012C5210
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C5210 mov eax, dword ptr fs:[00000030h]	13_2_012C5210
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0130927A mov eax, dword ptr fs:[00000030h]	13_2_0130927A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0137B260 mov eax, dword ptr fs:[00000030h]	13_2_0137B260
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0137B260 mov eax, dword ptr fs:[00000030h]	13_2_0137B260
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01398A62 mov eax, dword ptr fs:[00000030h]	13_2_01398A62
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01354257 mov eax, dword ptr fs:[00000030h]	13_2_01354257
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9240 mov eax, dword ptr fs:[00000030h]	13_2_012C9240
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9240 mov eax, dword ptr fs:[00000030h]	13_2_012C9240
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9240 mov eax, dword ptr fs:[00000030h]	13_2_012C9240
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C9240 mov eax, dword ptr fs:[00000030h]	13_2_012C9240
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138EA55 mov eax, dword ptr fs:[00000030h]	13_2_0138EA55
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C52A5 mov eax, dword ptr fs:[00000030h]	13_2_012C52A5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C52A5 mov eax, dword ptr fs:[00000030h]	13_2_012C52A5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C52A5 mov eax, dword ptr fs:[00000030h]	13_2_012C52A5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C52A5 mov eax, dword ptr fs:[00000030h]	13_2_012C52A5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C52A5 mov eax, dword ptr fs:[00000030h]	13_2_012C52A5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DAAB0 mov eax, dword ptr fs:[00000030h]	13_2_012DAAB0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DAAB0 mov eax, dword ptr fs:[00000030h]	13_2_012DAAB0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FFAB0 mov eax, dword ptr fs:[00000030h]	13_2_012FFAB0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FD294 mov eax, dword ptr fs:[00000030h]	13_2_012FD294
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FD294 mov eax, dword ptr fs:[00000030h]	13_2_012FD294
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2AE4 mov eax, dword ptr fs:[00000030h]	13_2_012F2AE4
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2ACB mov eax, dword ptr fs:[00000030h]	13_2_012F2ACB
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138E539 mov eax, dword ptr fs:[00000030h]	13_2_0138E539
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0134A537 mov eax, dword ptr fs:[00000030h]	13_2_0134A537
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01398D34 mov eax, dword ptr fs:[00000030h]	13_2_01398D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F4D3B mov eax, dword ptr fs:[00000030h]	13_2_012F4D3B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F4D3B mov eax, dword ptr fs:[00000030h]	13_2_012F4D3B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F4D3B mov eax, dword ptr fs:[00000030h]	13_2_012F4D3B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D3D34 mov eax, dword ptr fs:[00000030h]	13_2_012D3D34
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CAD30 mov eax, dword ptr fs:[00000030h]	13_2_012CAD30
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EC577 mov eax, dword ptr fs:[00000030h]	13_2_012EC577
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EC577 mov eax, dword ptr fs:[00000030h]	13_2_012EC577
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01303D43 mov eax, dword ptr fs:[00000030h]	13_2_01303D43
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01343540 mov eax, dword ptr fs:[00000030h]	13_2_01343540
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E7D50 mov eax, dword ptr fs:[00000030h]	13_2_012E7D50
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F35A1 mov eax, dword ptr fs:[00000030h]	13_2_012F35A1
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013905AC mov eax, dword ptr fs:[00000030h]	13_2_013905AC
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013905AC mov eax, dword ptr fs:[00000030h]	13_2_013905AC
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F1DB5 mov eax, dword ptr fs:[00000030h]	13_2_012F1DB5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F1DB5 mov eax, dword ptr fs:[00000030h]	13_2_012F1DB5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F1DB5 mov eax, dword ptr fs:[00000030h]	13_2_012F1DB5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C2D8A mov eax, dword ptr fs:[00000030h]	13_2_012C2D8A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C2D8A mov eax, dword ptr fs:[00000030h]	13_2_012C2D8A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C2D8A mov eax, dword ptr fs:[00000030h]	13_2_012C2D8A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C2D8A mov eax, dword ptr fs:[00000030h]	13_2_012C2D8A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C2D8A mov eax, dword ptr fs:[00000030h]	13_2_012C2D8A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2581 mov eax, dword ptr fs:[00000030h]	13_2_012F2581
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2581 mov eax, dword ptr fs:[00000030h]	13_2_012F2581
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2581 mov eax, dword ptr fs:[00000030h]	13_2_012F2581
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F2581 mov eax, dword ptr fs:[00000030h]	13_2_012F2581
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FFD9B mov eax, dword ptr fs:[00000030h]	13_2_012FFD9B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FFD9B mov eax, dword ptr fs:[00000030h]	13_2_012FFD9B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01378DF1 mov eax, dword ptr fs:[00000030h]	13_2_01378DF1
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DD5E0 mov eax, dword ptr fs:[00000030h]	13_2_012DD5E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DD5E0 mov eax, dword ptr fs:[00000030h]	13_2_012DD5E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0138FDE2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0138FDE2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0138FDE2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138FDE2 mov eax, dword ptr fs:[00000030h]	13_2_0138FDE2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346DC9 mov eax, dword ptr fs:[00000030h]	13_2_01346DC9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346DC9 mov eax, dword ptr fs:[00000030h]	13_2_01346DC9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346DC9 mov eax, dword ptr fs:[00000030h]	13_2_01346DC9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346DC9 mov ecx, dword ptr fs:[00000030h]	13_2_01346DC9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346DC9 mov eax, dword ptr fs:[00000030h]	13_2_01346DC9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346DC9 mov eax, dword ptr fs:[00000030h]	13_2_01346DC9
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FBC2C mov eax, dword ptr fs:[00000030h]	13_2_012FBC2C
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0139740D mov eax, dword ptr fs:[00000030h]	13_2_0139740D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0139740D mov eax, dword ptr fs:[00000030h]	13_2_0139740D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0139740D mov eax, dword ptr fs:[00000030h]	13_2_0139740D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381C06 mov eax, dword ptr fs:[00000030h]	13_2_01381C06
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346C0A mov eax, dword ptr fs:[00000030h]	13_2_01346C0A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346C0A mov eax, dword ptr fs:[00000030h]	13_2_01346C0A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346C0A mov eax, dword ptr fs:[00000030h]	13_2_01346C0A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346C0A mov eax, dword ptr fs:[00000030h]	13_2_01346C0A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012E746D mov eax, dword ptr fs:[00000030h]	13_2_012E746D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FA44B mov eax, dword ptr fs:[00000030h]	13_2_012FA44B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135C450 mov eax, dword ptr fs:[00000030h]	13_2_0135C450
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135C450 mov eax, dword ptr fs:[00000030h]	13_2_0135C450
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D849B mov eax, dword ptr fs:[00000030h]	13_2_012D849B
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013814FB mov eax, dword ptr fs:[00000030h]	13_2_013814FB
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346CF0 mov eax, dword ptr fs:[00000030h]	13_2_01346CF0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346CF0 mov eax, dword ptr fs:[00000030h]	13_2_01346CF0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01346CF0 mov eax, dword ptr fs:[00000030h]	13_2_01346CF0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01398CD6 mov eax, dword ptr fs:[00000030h]	13_2_01398CD6
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C4F2E mov eax, dword ptr fs:[00000030h]	13_2_012C4F2E
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012C4F2E mov eax, dword ptr fs:[00000030h]	13_2_012C4F2E
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FE730 mov eax, dword ptr fs:[00000030h]	13_2_012FE730
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FA70E mov eax, dword ptr fs:[00000030h]	13_2_012FA70E
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FA70E mov eax, dword ptr fs:[00000030h]	13_2_012FA70E
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135FF10 mov eax, dword ptr fs:[00000030h]	13_2_0135FF10
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135FF10 mov eax, dword ptr fs:[00000030h]	13_2_0135FF10
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0139070D mov eax, dword ptr fs:[00000030h]	13_2_0139070D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0139070D mov eax, dword ptr fs:[00000030h]	13_2_0139070D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EF716 mov eax, dword ptr fs:[00000030h]	13_2_012EF716
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DFF60 mov eax, dword ptr fs:[00000030h]	13_2_012DFF60
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01398F6A mov eax, dword ptr fs:[00000030h]	13_2_01398F6A
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012DEF40 mov eax, dword ptr fs:[00000030h]	13_2_012DEF40
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01347794 mov eax, dword ptr fs:[00000030h]	13_2_01347794
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01347794 mov eax, dword ptr fs:[00000030h]	13_2_01347794
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01347794 mov eax, dword ptr fs:[00000030h]	13_2_01347794
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D8794 mov eax, dword ptr fs:[00000030h]	13_2_012D8794
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013037F5 mov eax, dword ptr fs:[00000030h]	13_2_013037F5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0137FE3F mov eax, dword ptr fs:[00000030h]	13_2_0137FE3F
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CE620 mov eax, dword ptr fs:[00000030h]	13_2_012CE620
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CC600 mov eax, dword ptr fs:[00000030h]	13_2_012CC600
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CC600 mov eax, dword ptr fs:[00000030h]	13_2_012CC600
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012CC600 mov eax, dword ptr fs:[00000030h]	13_2_012CC600
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F8E00 mov eax, dword ptr fs:[00000030h]	13_2_012F8E00
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01381608 mov eax, dword ptr fs:[00000030h]	13_2_01381608
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FA61C mov eax, dword ptr fs:[00000030h]	13_2_012FA61C
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012FA61C mov eax, dword ptr fs:[00000030h]	13_2_012FA61C
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D766D mov eax, dword ptr fs:[00000030h]	13_2_012D766D
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EAE73 mov eax, dword ptr fs:[00000030h]	13_2_012EAE73
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EAE73 mov eax, dword ptr fs:[00000030h]	13_2_012EAE73
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EAE73 mov eax, dword ptr fs:[00000030h]	13_2_012EAE73
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EAE73 mov eax, dword ptr fs:[00000030h]	13_2_012EAE73
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012EAE73 mov eax, dword ptr fs:[00000030h]	13_2_012EAE73
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D7E41 mov eax, dword ptr fs:[00000030h]	13_2_012D7E41
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D7E41 mov eax, dword ptr fs:[00000030h]	13_2_012D7E41
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D7E41 mov eax, dword ptr fs:[00000030h]	13_2_012D7E41
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D7E41 mov eax, dword ptr fs:[00000030h]	13_2_012D7E41
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D7E41 mov eax, dword ptr fs:[00000030h]	13_2_012D7E41
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D7E41 mov eax, dword ptr fs:[00000030h]	13_2_012D7E41
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138AE44 mov eax, dword ptr fs:[00000030h]	13_2_0138AE44
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0138AE44 mov eax, dword ptr fs:[00000030h]	13_2_0138AE44
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_013446A7 mov eax, dword ptr fs:[00000030h]	13_2_013446A7
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01390EA5 mov eax, dword ptr fs:[00000030h]	13_2_01390EA5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01390EA5 mov eax, dword ptr fs:[00000030h]	13_2_01390EA5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01390EA5 mov eax, dword ptr fs:[00000030h]	13_2_01390EA5
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0135FE87 mov eax, dword ptr fs:[00000030h]	13_2_0135FE87
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F16E0 mov ecx, dword ptr fs:[00000030h]	13_2_012F16E0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012D76E2 mov eax, dword ptr fs:[00000030h]	13_2_012D76E2
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_012F36CC mov eax, dword ptr fs:[00000030h]	13_2_012F36CC
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01398ED6 mov eax, dword ptr fs:[00000030h]	13_2_01398ED6
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_0137FEC0 mov eax, dword ptr fs:[00000030h]	13_2_0137FEC0
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Code function: 13_2_01308EC7 mov eax, dword ptr fs:[00000030h]	13_2_01308EC7
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05214120 mov eax, dword ptr fs:[00000030h]	21_2_05214120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05214120 mov eax, dword ptr fs:[00000030h]	21_2_05214120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05214120 mov eax, dword ptr fs:[00000030h]	21_2_05214120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05214120 mov eax, dword ptr fs:[00000030h]	21_2_05214120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05214120 mov ecx, dword ptr fs:[00000030h]	21_2_05214120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0527A537 mov eax, dword ptr fs:[00000030h]	21_2_0527A537
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052BE539 mov eax, dword ptr fs:[00000030h]	21_2_052BE539
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05203D34 mov eax, dword ptr fs:[00000030h]	21_2_05203D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C8D34 mov eax, dword ptr fs:[00000030h]	21_2_052C8D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522513A mov eax, dword ptr fs:[00000030h]	21_2_0522513A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522513A mov eax, dword ptr fs:[00000030h]	21_2_0522513A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05224D3B mov eax, dword ptr fs:[00000030h]	21_2_05224D3B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05224D3B mov eax, dword ptr fs:[00000030h]	21_2_05224D3B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05224D3B mov eax, dword ptr fs:[00000030h]	21_2_05224D3B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9100 mov eax, dword ptr fs:[00000030h]	21_2_051F9100
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9100 mov eax, dword ptr fs:[00000030h]	21_2_051F9100
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9100 mov eax, dword ptr fs:[00000030h]	21_2_051F9100
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FAD30 mov eax, dword ptr fs:[00000030h]	21_2_051FAD30
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521C577 mov eax, dword ptr fs:[00000030h]	21_2_0521C577
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521C577 mov eax, dword ptr fs:[00000030h]	21_2_0521C577
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05233D43 mov eax, dword ptr fs:[00000030h]	21_2_05233D43
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521B944 mov eax, dword ptr fs:[00000030h]	21_2_0521B944
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521B944 mov eax, dword ptr fs:[00000030h]	21_2_0521B944
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05273540 mov eax, dword ptr fs:[00000030h]	21_2_05273540
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FB171 mov eax, dword ptr fs:[00000030h]	21_2_051FB171
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FB171 mov eax, dword ptr fs:[00000030h]	21_2_051FB171
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05217D50 mov eax, dword ptr fs:[00000030h]	21_2_05217D50
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FC962 mov eax, dword ptr fs:[00000030h]	21_2_051FC962
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C05AC mov eax, dword ptr fs:[00000030h]	21_2_052C05AC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C05AC mov eax, dword ptr fs:[00000030h]	21_2_052C05AC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052769A6 mov eax, dword ptr fs:[00000030h]	21_2_052769A6
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052261A0 mov eax, dword ptr fs:[00000030h]	21_2_052261A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052261A0 mov eax, dword ptr fs:[00000030h]	21_2_052261A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052235A1 mov eax, dword ptr fs:[00000030h]	21_2_052235A1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F2D8A mov eax, dword ptr fs:[00000030h]	21_2_051F2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F2D8A mov eax, dword ptr fs:[00000030h]	21_2_051F2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F2D8A mov eax, dword ptr fs:[00000030h]	21_2_051F2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F2D8A mov eax, dword ptr fs:[00000030h]	21_2_051F2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F2D8A mov eax, dword ptr fs:[00000030h]	21_2_051F2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05221DB5 mov eax, dword ptr fs:[00000030h]	21_2_05221DB5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05221DB5 mov eax, dword ptr fs:[00000030h]	21_2_05221DB5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05221DB5 mov eax, dword ptr fs:[00000030h]	21_2_05221DB5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052751BE mov eax, dword ptr fs:[00000030h]	21_2_052751BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052751BE mov eax, dword ptr fs:[00000030h]	21_2_052751BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052751BE mov eax, dword ptr fs:[00000030h]	21_2_052751BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052751BE mov eax, dword ptr fs:[00000030h]	21_2_052751BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521C182 mov eax, dword ptr fs:[00000030h]	21_2_0521C182
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222581 mov eax, dword ptr fs:[00000030h]	21_2_05222581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222581 mov eax, dword ptr fs:[00000030h]	21_2_05222581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222581 mov eax, dword ptr fs:[00000030h]	21_2_05222581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222581 mov eax, dword ptr fs:[00000030h]	21_2_05222581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522A185 mov eax, dword ptr fs:[00000030h]	21_2_0522A185
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222990 mov eax, dword ptr fs:[00000030h]	21_2_05222990
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522FD9B mov eax, dword ptr fs:[00000030h]	21_2_0522FD9B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522FD9B mov eax, dword ptr fs:[00000030h]	21_2_0522FD9B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052841E8 mov eax, dword ptr fs:[00000030h]	21_2_052841E8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520D5E0 mov eax, dword ptr fs:[00000030h]	21_2_0520D5E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520D5E0 mov eax, dword ptr fs:[00000030h]	21_2_0520D5E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052BFDE2 mov eax, dword ptr fs:[00000030h]	21_2_052BFDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052BFDE2 mov eax, dword ptr fs:[00000030h]	21_2_052BFDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052BFDE2 mov eax, dword ptr fs:[00000030h]	21_2_052BFDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052BFDE2 mov eax, dword ptr fs:[00000030h]	21_2_052BFDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052A8DF1 mov eax, dword ptr fs:[00000030h]	21_2_052A8DF1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276DC9 mov eax, dword ptr fs:[00000030h]	21_2_05276DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276DC9 mov eax, dword ptr fs:[00000030h]	21_2_05276DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276DC9 mov eax, dword ptr fs:[00000030h]	21_2_05276DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276DC9 mov ecx, dword ptr fs:[00000030h]	21_2_05276DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276DC9 mov eax, dword ptr fs:[00000030h]	21_2_05276DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276DC9 mov eax, dword ptr fs:[00000030h]	21_2_05276DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FB1E1 mov eax, dword ptr fs:[00000030h]	21_2_051FB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FB1E1 mov eax, dword ptr fs:[00000030h]	21_2_051FB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FB1E1 mov eax, dword ptr fs:[00000030h]	21_2_051FB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520B02A mov eax, dword ptr fs:[00000030h]	21_2_0520B02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520B02A mov eax, dword ptr fs:[00000030h]	21_2_0520B02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520B02A mov eax, dword ptr fs:[00000030h]	21_2_0520B02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520B02A mov eax, dword ptr fs:[00000030h]	21_2_0520B02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522BC2C mov eax, dword ptr fs:[00000030h]	21_2_0522BC2C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522002D mov eax, dword ptr fs:[00000030h]	21_2_0522002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522002D mov eax, dword ptr fs:[00000030h]	21_2_0522002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522002D mov eax, dword ptr fs:[00000030h]	21_2_0522002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522002D mov eax, dword ptr fs:[00000030h]	21_2_0522002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522002D mov eax, dword ptr fs:[00000030h]	21_2_0522002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C740D mov eax, dword ptr fs:[00000030h]	21_2_052C740D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C740D mov eax, dword ptr fs:[00000030h]	21_2_052C740D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C740D mov eax, dword ptr fs:[00000030h]	21_2_052C740D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1C06 mov eax, dword ptr fs:[00000030h]	21_2_052B1C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276C0A mov eax, dword ptr fs:[00000030h]	21_2_05276C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276C0A mov eax, dword ptr fs:[00000030h]	21_2_05276C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276C0A mov eax, dword ptr fs:[00000030h]	21_2_05276C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276C0A mov eax, dword ptr fs:[00000030h]	21_2_05276C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05277016 mov eax, dword ptr fs:[00000030h]	21_2_05277016
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05277016 mov eax, dword ptr fs:[00000030h]	21_2_05277016
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05277016 mov eax, dword ptr fs:[00000030h]	21_2_05277016
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C4015 mov eax, dword ptr fs:[00000030h]	21_2_052C4015
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C4015 mov eax, dword ptr fs:[00000030h]	21_2_052C4015
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521746D mov eax, dword ptr fs:[00000030h]	21_2_0521746D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B2073 mov eax, dword ptr fs:[00000030h]	21_2_052B2073
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C1074 mov eax, dword ptr fs:[00000030h]	21_2_052C1074
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522A44B mov eax, dword ptr fs:[00000030h]	21_2_0522A44B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05210050 mov eax, dword ptr fs:[00000030h]	21_2_05210050
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05210050 mov eax, dword ptr fs:[00000030h]	21_2_05210050
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528C450 mov eax, dword ptr fs:[00000030h]	21_2_0528C450
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528C450 mov eax, dword ptr fs:[00000030h]	21_2_0528C450
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0 mov eax, dword ptr fs:[00000030h]	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0 mov eax, dword ptr fs:[00000030h]	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0 mov eax, dword ptr fs:[00000030h]	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0 mov eax, dword ptr fs:[00000030h]	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0 mov eax, dword ptr fs:[00000030h]	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052220A0 mov eax, dword ptr fs:[00000030h]	21_2_052220A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052390AF mov eax, dword ptr fs:[00000030h]	21_2_052390AF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522F0BF mov ecx, dword ptr fs:[00000030h]	21_2_0522F0BF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522F0BF mov eax, dword ptr fs:[00000030h]	21_2_0522F0BF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522F0BF mov eax, dword ptr fs:[00000030h]	21_2_0522F0BF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9080 mov eax, dword ptr fs:[00000030h]	21_2_051F9080
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05273884 mov eax, dword ptr fs:[00000030h]	21_2_05273884
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05273884 mov eax, dword ptr fs:[00000030h]	21_2_05273884
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520849B mov eax, dword ptr fs:[00000030h]	21_2_0520849B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B14FB mov eax, dword ptr fs:[00000030h]	21_2_052B14FB
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276CF0 mov eax, dword ptr fs:[00000030h]	21_2_05276CF0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276CF0 mov eax, dword ptr fs:[00000030h]	21_2_05276CF0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05276CF0 mov eax, dword ptr fs:[00000030h]	21_2_05276CF0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F58EC mov eax, dword ptr fs:[00000030h]	21_2_051F58EC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528B8D0 mov eax, dword ptr fs:[00000030h]	21_2_0528B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528B8D0 mov ecx, dword ptr fs:[00000030h]	21_2_0528B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528B8D0 mov eax, dword ptr fs:[00000030h]	21_2_0528B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528B8D0 mov eax, dword ptr fs:[00000030h]	21_2_0528B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528B8D0 mov eax, dword ptr fs:[00000030h]	21_2_0528B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528B8D0 mov eax, dword ptr fs:[00000030h]	21_2_0528B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C8CD6 mov eax, dword ptr fs:[00000030h]	21_2_052C8CD6
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522E730 mov eax, dword ptr fs:[00000030h]	21_2_0522E730
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C070D mov eax, dword ptr fs:[00000030h]	21_2_052C070D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C070D mov eax, dword ptr fs:[00000030h]	21_2_052C070D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522A70E mov eax, dword ptr fs:[00000030h]	21_2_0522A70E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522A70E mov eax, dword ptr fs:[00000030h]	21_2_0522A70E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B131B mov eax, dword ptr fs:[00000030h]	21_2_052B131B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F4F2E mov eax, dword ptr fs:[00000030h]	21_2_051F4F2E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F4F2E mov eax, dword ptr fs:[00000030h]	21_2_051F4F2E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521F716 mov eax, dword ptr fs:[00000030h]	21_2_0521F716
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528FF10 mov eax, dword ptr fs:[00000030h]	21_2_0528FF10
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0528FF10 mov eax, dword ptr fs:[00000030h]	21_2_0528FF10
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520FF60 mov eax, dword ptr fs:[00000030h]	21_2_0520FF60
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C8F6A mov eax, dword ptr fs:[00000030h]	21_2_052C8F6A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FF358 mov eax, dword ptr fs:[00000030h]	21_2_051FF358
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05223B7A mov eax, dword ptr fs:[00000030h]	21_2_05223B7A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05223B7A mov eax, dword ptr fs:[00000030h]	21_2_05223B7A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FDB40 mov eax, dword ptr fs:[00000030h]	21_2_051FDB40
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520EF40 mov eax, dword ptr fs:[00000030h]	21_2_0520EF40
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C8B58 mov eax, dword ptr fs:[00000030h]	21_2_052C8B58
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FDB60 mov ecx, dword ptr fs:[00000030h]	21_2_051FDB60
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C5BA5 mov eax, dword ptr fs:[00000030h]	21_2_052C5BA5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05224BAD mov eax, dword ptr fs:[00000030h]	21_2_05224BAD
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05224BAD mov eax, dword ptr fs:[00000030h]	21_2_05224BAD
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05224BAD mov eax, dword ptr fs:[00000030h]	21_2_05224BAD
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B138A mov eax, dword ptr fs:[00000030h]	21_2_052B138A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052AD380 mov ecx, dword ptr fs:[00000030h]	21_2_052AD380
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05201B8F mov eax, dword ptr fs:[00000030h]	21_2_05201B8F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05201B8F mov eax, dword ptr fs:[00000030h]	21_2_05201B8F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522B390 mov eax, dword ptr fs:[00000030h]	21_2_0522B390
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05277794 mov eax, dword ptr fs:[00000030h]	21_2_05277794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05277794 mov eax, dword ptr fs:[00000030h]	21_2_05277794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05277794 mov eax, dword ptr fs:[00000030h]	21_2_05277794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05208794 mov eax, dword ptr fs:[00000030h]	21_2_05208794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05222397 mov eax, dword ptr fs:[00000030h]	21_2_05222397
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052203E2 mov eax, dword ptr fs:[00000030h]	21_2_052203E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052203E2 mov eax, dword ptr fs:[00000030h]	21_2_052203E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052203E2 mov eax, dword ptr fs:[00000030h]	21_2_052203E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052203E2 mov eax, dword ptr fs:[00000030h]	21_2_052203E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052203E2 mov eax, dword ptr fs:[00000030h]	21_2_052203E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052203E2 mov eax, dword ptr fs:[00000030h]	21_2_052203E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521DBE9 mov eax, dword ptr fs:[00000030h]	21_2_0521DBE9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052337F5 mov eax, dword ptr fs:[00000030h]	21_2_052337F5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052753CA mov eax, dword ptr fs:[00000030h]	21_2_052753CA
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052753CA mov eax, dword ptr fs:[00000030h]	21_2_052753CA
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FAA16 mov eax, dword ptr fs:[00000030h]	21_2_051FAA16
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FAA16 mov eax, dword ptr fs:[00000030h]	21_2_051FAA16
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05234A2C mov eax, dword ptr fs:[00000030h]	21_2_05234A2C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05234A2C mov eax, dword ptr fs:[00000030h]	21_2_05234A2C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F5210 mov eax, dword ptr fs:[00000030h]	21_2_051F5210
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F5210 mov ecx, dword ptr fs:[00000030h]	21_2_051F5210
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F5210 mov eax, dword ptr fs:[00000030h]	21_2_051F5210
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F5210 mov eax, dword ptr fs:[00000030h]	21_2_051F5210
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052AFE3F mov eax, dword ptr fs:[00000030h]	21_2_052AFE3F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FC600 mov eax, dword ptr fs:[00000030h]	21_2_051FC600
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FC600 mov eax, dword ptr fs:[00000030h]	21_2_051FC600
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FC600 mov eax, dword ptr fs:[00000030h]	21_2_051FC600
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05228E00 mov eax, dword ptr fs:[00000030h]	21_2_05228E00
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052B1608 mov eax, dword ptr fs:[00000030h]	21_2_052B1608
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05208A0A mov eax, dword ptr fs:[00000030h]	21_2_05208A0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05213A1C mov eax, dword ptr fs:[00000030h]	21_2_05213A1C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522A61C mov eax, dword ptr fs:[00000030h]	21_2_0522A61C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0522A61C mov eax, dword ptr fs:[00000030h]	21_2_0522A61C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051FE620 mov eax, dword ptr fs:[00000030h]	21_2_051FE620
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052AB260 mov eax, dword ptr fs:[00000030h]	21_2_052AB260
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052AB260 mov eax, dword ptr fs:[00000030h]	21_2_052AB260
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0520766D mov eax, dword ptr fs:[00000030h]	21_2_0520766D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_052C8A62 mov eax, dword ptr fs:[00000030h]	21_2_052C8A62
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521AE73 mov eax, dword ptr fs:[00000030h]	21_2_0521AE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521AE73 mov eax, dword ptr fs:[00000030h]	21_2_0521AE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521AE73 mov eax, dword ptr fs:[00000030h]	21_2_0521AE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521AE73 mov eax, dword ptr fs:[00000030h]	21_2_0521AE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0521AE73 mov eax, dword ptr fs:[00000030h]	21_2_0521AE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_0523927A mov eax, dword ptr fs:[00000030h]	21_2_0523927A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9240 mov eax, dword ptr fs:[00000030h]	21_2_051F9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9240 mov eax, dword ptr fs:[00000030h]	21_2_051F9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9240 mov eax, dword ptr fs:[00000030h]	21_2_051F9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_051F9240 mov eax, dword ptr fs:[00000030h]	21_2_051F9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05207E41 mov eax, dword ptr fs:[00000030h]	21_2_05207E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05207E41 mov eax, dword ptr fs:[00000030h]	21_2_05207E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 21_2_05207E41 mov eax, dword ptr fs:[00000030h]	21_2_05207E41

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe

Domain query: www.qiqihao.site

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Thread register set: target process: 3388	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Thread register set: target process: 3388	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Thread register set: target process: 3388	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe

Section unmapped: C:\Windows\SysWOW64\cmmon32.exe base address: F80000

Jump to behavior

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Process created: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	Process created: C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmmon32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe'	Jump to behavior

Source: explorer.exe, 0000000E.00000000.331493811.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 0000000E.00000002.466093643.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000015.00000002.464305174.00000000039D0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000E.00000002.466093643.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000015.00000002.464305174.00000000039D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000002.466093643.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000015.00000002.464305174.00000000039D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000002.466093643.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000015.00000002.464305174.00000000039D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection512	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection512	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Inquiry_10_05_2021,pdf.exe	35%	Metadefender		Browse
Inquiry_10_05_2021,pdf.exe	53%	ReversingLabs	ByteCode-MSIL.Downloader.Seraph
Inquiry_10_05_2021,pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	35%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe	53%	ReversingLabs	ByteCode-MSIL.Downloader.Seraph

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
13.2.Inquiry_10_05_2021,pdf.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
www.werealestatephotography.com/hw6d/	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
parkingpage.namecheap.com	198.54.117.215	true	false	high
thevillaflora.com	192.0.78.24	true	true	unknown
www.qiqihao.site	unknown	unknown	true	unknown
www.thevillaflora.com	unknown	unknown	true	unknown
www.thenewyorker.computer	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.werealestatephotography.com/hw6d/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://james.newtonking.com/projects/json	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.328996100.000000000397E000.00000004.00000001.sdmp	false		high
http://www.fonts.com	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.327976941.0000000002814000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	Inquiry_10_05_2021,pdf.exe, 00000000.00000002.333247241.0000000006A22000.00000004.00000001.sdmp, explorer.exe, 0000000E.00000000.352497565.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	411852
Start date:	12.05.2021
Start time:	07:48:43
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Inquiry_10_05_2021,pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/3@3/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 10.8% (good quality ratio 9.7%) Quality average: 72.3% Quality standard deviation: 31.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 152
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 93.184.220.29, 13.64.90.137, 23.218.208.56, 2.20.143.16, 2.20.142.209, 20.190.160.75, 20.190.160.73, 20.190.160.129, 20.190.160.134, 20.190.160.71, 20.190.160.67, 20.190.160.136, 20.190.160.69, 20.82.210.154, 92.122.213.247, 92.122.213.194, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, cs9.wac.phicdn.net, www.tm.lg.prod.aadmsa.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ocsp.digicert.com, login.live.com, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/411852/sample/Inquiry_10_05_2021,pdf.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
parkingpage.namecheap.com	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	Get hash	malicious	Browse	198.54.117.212
	NAVTECO_R1_10_05_2021,pdf.exe	Get hash	malicious	Browse	198.54.117.212
	POI09876OIUY.exe	Get hash	malicious	Browse	198.54.117.210
	EDS03932,pdf.exe	Get hash	malicious	Browse	198.54.117.216
	Purchase Order.exe	Get hash	malicious	Browse	198.54.117.216
	slot Charges.exe	Get hash	malicious	Browse	198.54.117.216
	PO09641.exe	Get hash	malicious	Browse	198.54.117.215
	BORMAR SA_Cotizaci#U00f3n de producto doc.exe	Get hash	malicious	Browse	198.54.117.211
	Purchase Order-10764.exe	Get hash	malicious	Browse	198.54.117.212
	4LkSpeVqKR.exe	Get hash	malicious	Browse	198.54.117.218
	2B0CsHzr8o.exe	Get hash	malicious	Browse	198.54.117.216
	60b88477_by_Libranalysis.exe	Get hash	malicious	Browse	198.54.117.215
	DHL Receipt_AWB811470484778.exe	Get hash	malicious	Browse	198.54.117.217
	NEW ORDER.exe	Get hash	malicious	Browse	198.54.117.217
	0876543123.exe	Get hash	malicious	Browse	198.54.117.210
	g1EhgmCqCD.exe	Get hash	malicious	Browse	198.54.117.216
	Payment.xlsx	Get hash	malicious	Browse	198.54.117.210
	w73FtMA4ZTl9NFm.exe	Get hash	malicious	Browse	198.54.117.212
	Remittance Advice pdf.exe	Get hash	malicious	Browse	198.54.117.212
	d801e424_by_Libranalysis.docx	Get hash	malicious	Browse	198.54.117.218

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry_10_05_2021,pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1119
Entropy (8bit):	5.356708753875314
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzd
MD5:	3197B1D4714B56F2A6AC9E83761739AE
SHA1:	3B38010F0DF51C1D4D2C020138202DABB686741D
SHA-256:	40586572180B85042FEFED9F367B43831C5D269751D9F3940BBC29B41E18E9F6
SHA-512:	58EC975A53AD9B19B425F6C6843A94CC280F794D436BBF3D29D8B76CA1E8C2D8883B3E754F9D4F2C9E9387FE88825CCD9919369A5446B1AFF73EDBE07FA94D88
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe Download File
Process:	C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	551936
Entropy (8bit):	7.85215330618776
Encrypted:	false
SSDEEP:	12288:OHFMw7Y9MA59CyMAn0pGZVkfK6Jaei3kqh6PehkHFRAomlTx:OH+w09tVSKLkqh6P3lRAoqTx
MD5:	D394A8C0A37BCDAF432B2882714C6EBA
SHA1:	52D386445E50600A920F16692BBF30829D08932C
SHA-256:	3F4DC309BE69548972299CB0517C884BCB5A472FBF9693FF3D07776C9464AF1C
SHA-512:	1EBCC07FA5409255BE3803B1286C693B2271237A9B436743AB79BC3380C6442895549506886416B6FC9F7A99B2A1133267A3B9DF9FF023BB61EF8A4674F76370
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 35%, Browse Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`.................X...........w... ........@.. ....................................@..................................w..J.................................................................................... ............... ..H............text....X... ...X.................. ..`.rsrc................Z..............@..@.reloc...............j..............@..B.................w......H........&..D............;...<..........................................^..}.....(.......(......0..e.........%-.+;+.. ....+4.-...,..+1.%,.X+-.-.++....+(+)-.+(+-.(....(....&.+.(....+..+..+..+..+..+.s....+..+.....0..^........+8,.+7{.......+..+-.-.++,..-...-.+#{....+...,...-.+.+.+...+..+..+..+..+.o....+..+..+.(....+...".(........".(........".(........f+.+.{....+..+..+.o....+....0..U.........,.+%..+(..-.+).......s....+"..-.+#+(..-.(....+.(....+.(....+.o....+.s....+.(....+

C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:
Entropy (8bit):	7.85215330618776
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Inquiry_10_05_2021,pdf.exe
File size:	551936
MD5:	d394a8c0a37bcdaf432b2882714c6eba
SHA1:	52d386445e50600a920f16692bbf30829d08932c
SHA256:	3f4dc309be69548972299cb0517c884bcb5a472fbf9693ff3d07776c9464af1c
SHA512:	1ebcc07fa5409255be3803b1286c693b2271237a9b436743ab79bc3380c6442895549506886416b6fc9f7a99b2a1133267a3b9df9ff023bb61ef8a4674f76370
SSDEEP:	12288:OHFMw7Y9MA59CyMAn0pGZVkfK6Jaei3kqh6PehkHFRAomlTx:OH+w09tVSKLkqh6P3lRAoqTx
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................X...........w... ........@.. ....................................@................................

File Icon


Icon Hash:	f6a6a68e9af2f074

Static PE Info

General
Entrypoint:	0x4777fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6098A9D5 [Mon May 10 03:34:45 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x777b0	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x78000	0x10efc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x75800	0x75800	False	0.993184840426	data	7.99403499414	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x78000	0x10efc	0x11000	False	0.165067784926	data	5.0205162412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x7806c	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x888d0	0x14	data
RT_VERSION	0x88920	0x3b6	data
RT_MANIFEST	0x88d12	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2020 Google LLC. All rights reserved.
Assembly Version	90.0.4430.93
InternalName	Irqoouoq.exe
FileVersion	90.0.4430.93
CompanyName	Google LLC
LegalTrademarks
Comments	Google Chrome
ProductName	Google Chrome
ProductVersion	90.0.4430.93
FileDescription	Google Chrome
OriginalFilename	Irqoouoq.exe

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 07:49:21.256098986 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:21.304995060 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 07:49:21.889221907 CEST	60152	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:21.937774897 CEST	53	60152	8.8.8.8	192.168.2.3
May 12, 2021 07:49:23.273726940 CEST	57544	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:23.325436115 CEST	53	57544	8.8.8.8	192.168.2.3
May 12, 2021 07:49:24.388642073 CEST	55984	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:24.440272093 CEST	53	55984	8.8.8.8	192.168.2.3
May 12, 2021 07:49:25.728013039 CEST	64185	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:25.776848078 CEST	53	64185	8.8.8.8	192.168.2.3
May 12, 2021 07:49:27.065495014 CEST	65110	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:27.114459038 CEST	53	65110	8.8.8.8	192.168.2.3
May 12, 2021 07:49:28.324734926 CEST	58361	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:28.377542973 CEST	53	58361	8.8.8.8	192.168.2.3
May 12, 2021 07:49:29.706060886 CEST	63492	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:29.755786896 CEST	53	63492	8.8.8.8	192.168.2.3
May 12, 2021 07:49:30.905965090 CEST	60831	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:30.957581997 CEST	53	60831	8.8.8.8	192.168.2.3
May 12, 2021 07:49:32.058618069 CEST	60100	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:32.107301950 CEST	53	60100	8.8.8.8	192.168.2.3
May 12, 2021 07:49:33.303941011 CEST	53195	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:33.355504036 CEST	53	53195	8.8.8.8	192.168.2.3
May 12, 2021 07:49:34.451869011 CEST	50141	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:34.500504971 CEST	53	50141	8.8.8.8	192.168.2.3
May 12, 2021 07:49:35.558851004 CEST	53023	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:35.615962982 CEST	53	53023	8.8.8.8	192.168.2.3
May 12, 2021 07:49:36.897396088 CEST	49563	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:36.946857929 CEST	53	49563	8.8.8.8	192.168.2.3
May 12, 2021 07:49:38.023755074 CEST	51352	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:38.081182957 CEST	53	51352	8.8.8.8	192.168.2.3
May 12, 2021 07:49:39.141552925 CEST	59349	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:39.190644979 CEST	53	59349	8.8.8.8	192.168.2.3
May 12, 2021 07:49:40.209465981 CEST	57084	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:40.258169889 CEST	53	57084	8.8.8.8	192.168.2.3
May 12, 2021 07:49:41.310051918 CEST	58823	53	192.168.2.3	8.8.8.8
May 12, 2021 07:49:41.361665964 CEST	53	58823	8.8.8.8	192.168.2.3
May 12, 2021 07:50:00.487925053 CEST	57568	53	192.168.2.3	8.8.8.8
May 12, 2021 07:50:00.560127020 CEST	53	57568	8.8.8.8	192.168.2.3
May 12, 2021 07:50:17.261084080 CEST	50540	53	192.168.2.3	8.8.8.8
May 12, 2021 07:50:17.319989920 CEST	53	50540	8.8.8.8	192.168.2.3
May 12, 2021 07:50:33.764619112 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 07:50:33.844244003 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 07:50:38.134407997 CEST	53034	53	192.168.2.3	8.8.8.8
May 12, 2021 07:50:38.205677986 CEST	53	53034	8.8.8.8	192.168.2.3
May 12, 2021 07:50:47.037630081 CEST	57762	53	192.168.2.3	8.8.8.8
May 12, 2021 07:50:47.096478939 CEST	53	57762	8.8.8.8	192.168.2.3
May 12, 2021 07:51:00.579133987 CEST	55435	53	192.168.2.3	8.8.8.8
May 12, 2021 07:51:00.654954910 CEST	53	55435	8.8.8.8	192.168.2.3
May 12, 2021 07:51:18.932662010 CEST	50713	53	192.168.2.3	8.8.8.8
May 12, 2021 07:51:19.004630089 CEST	53	50713	8.8.8.8	192.168.2.3
May 12, 2021 07:51:24.825037003 CEST	56132	53	192.168.2.3	8.8.8.8
May 12, 2021 07:51:24.883832932 CEST	53	56132	8.8.8.8	192.168.2.3
May 12, 2021 07:51:31.640427113 CEST	58987	53	192.168.2.3	8.8.8.8
May 12, 2021 07:51:32.004530907 CEST	53	58987	8.8.8.8	192.168.2.3
May 12, 2021 07:51:37.019403934 CEST	56579	53	192.168.2.3	8.8.8.8
May 12, 2021 07:51:37.081526041 CEST	53	56579	8.8.8.8	192.168.2.3
May 12, 2021 07:51:42.176451921 CEST	60633	53	192.168.2.3	8.8.8.8
May 12, 2021 07:51:42.235138893 CEST	53	60633	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 07:51:31.640427113 CEST	192.168.2.3	8.8.8.8	0x3fc9	Standard query (0)	www.qiqihao.site	A (IP address)	IN (0x0001)
May 12, 2021 07:51:37.019403934 CEST	192.168.2.3	8.8.8.8	0x2b80	Standard query (0)	www.thevillaflora.com	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.176451921 CEST	192.168.2.3	8.8.8.8	0x5220	Standard query (0)	www.thenewyorker.computer	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 07:50:33.844244003 CEST	8.8.8.8	192.168.2.3	0xa9b7	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 07:51:32.004530907 CEST	8.8.8.8	192.168.2.3	0x3fc9	Name error (3)	www.qiqihao.site	none	none	A (IP address)	IN (0x0001)
May 12, 2021 07:51:37.081526041 CEST	8.8.8.8	192.168.2.3	0x2b80	No error (0)	www.thevillaflora.com	thevillaflora.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 07:51:37.081526041 CEST	8.8.8.8	192.168.2.3	0x2b80	No error (0)	thevillaflora.com		192.0.78.24	A (IP address)	IN (0x0001)
May 12, 2021 07:51:37.081526041 CEST	8.8.8.8	192.168.2.3	0x2b80	No error (0)	thevillaflora.com		192.0.78.25	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	www.thenewyorker.computer	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.215	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.217	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.211	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.210	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.218	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.212	A (IP address)	IN (0x0001)
May 12, 2021 07:51:42.235138893 CEST	8.8.8.8	192.168.2.3	0x5220	No error (0)	parkingpage.namecheap.com		198.54.117.216	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Inquiry_10_05_2021,pdf.exe PID: 1560 Parent PID: 5680

General

Start time:	07:49:28
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Inquiry_10_05_2021,pdf.exe'
Imagebase:	0x4e0000
File size:	551936 bytes
MD5 hash:	D394A8C0A37BCDAF432B2882714C6EBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.329149948.0000000003A30000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.328783834.00000000037D9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.328847245.000000000386E000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.328240255.0000000002995000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: Inquiry_10_05_2021,pdf.exe PID: 576 Parent PID: 1560

General

Start time:	07:50:28
Start date:	12/05/2021
Path:	C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe
Imagebase:	0x7a0000
File size:	551936 bytes
MD5 hash:	D394A8C0A37BCDAF432B2882714C6EBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.392729225.0000000000C90000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.392783029.0000000000CE0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 35%, Metadefender, Browse Detection: 53%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3388 Parent PID: 576

General

Start time:	07:50:30
Start date:	12/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: autochk.exe PID: 2156 Parent PID: 3388

General

Start time:	07:50:46
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\autochk.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autochk.exe
Imagebase:	0x820000
File size:	871424 bytes
MD5 hash:	34236DB574405291498BCD13D20C42EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmmon32.exe PID: 4772 Parent PID: 576

General

Start time:	07:50:59
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\cmmon32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmmon32.exe
Imagebase:	0xf80000
File size:	36864 bytes
MD5 hash:	2879B30A164B9F7671B5E6B2E9F8DFDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.463820601.00000000034E0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.463935334.0000000003510000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5068 Parent PID: 4772

General

Start time:	07:51:00
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\AppData\Local\Temp\Inquiry_10_05_2021,pdf.exe'
Imagebase:	0xad0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3776 Parent PID: 5068

General

Start time:	07:51:01
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Inquiry_10_05_2021,pdf.exe PID: 1560 Parent PID: 5680 Inquiry_10_05_2021,pdf.exeCOMMON

Executed Functions

Function 00C794D0, Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C79716

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f831f38848f775b57ddc0d308c1269a55d5f0f9a159b34c196956a41607a597
Instruction ID: 8eca7e705981f2c85b6195b803f244969f1f132343273ec22d66ce4d55328f38
Opcode Fuzzy Hash: 1f831f38848f775b57ddc0d308c1269a55d5f0f9a159b34c196956a41607a597
Instruction Fuzzy Hash: 767146B0A00B058FDB64DF2AD05579ABBF5FF88314F008A29E55AD7A40EB35E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C7FE2C, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C7FF4A

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e91dc5571457cdad5bf906f83c97c16678a9edd4bae4ad4e75d812e39bba10d1
Instruction ID: de6e635823805606b78c6f1aadbb7bf704172abc1cb63739af47ec8de3d0ac5e
Opcode Fuzzy Hash: e91dc5571457cdad5bf906f83c97c16678a9edd4bae4ad4e75d812e39bba10d1
Instruction Fuzzy Hash: FB51C2B1D003089FDB14CF99C984ADEBFF5BF49314F25812AE419AB250D7749946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C7ECC4, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C7FF4A

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4abb9a41b6a8a20a53bd005ade259cdda4dfe03eeaed2af3d916d9641208ff80
Instruction ID: 7061cac8ba842b5444d685eb90495e20cfe1a24b1c50caaa2d182ebc38ecd419
Opcode Fuzzy Hash: 4abb9a41b6a8a20a53bd005ade259cdda4dfe03eeaed2af3d916d9641208ff80
Instruction Fuzzy Hash: 1251A0B1D003499FDB14CF99C984ADEBBF5BF88314F24812EE819AB250D7749946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C7558C, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C75649

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d44516def4cea94b6333d7a10da0f4aa3dc348bcf4faf8bd1462d3784b68fa71
Instruction ID: db1e89a57af4ad1e172a5a6d72cb436333e8b0f81e4ec7c2dd26520a0ed065a0
Opcode Fuzzy Hash: d44516def4cea94b6333d7a10da0f4aa3dc348bcf4faf8bd1462d3784b68fa71
Instruction Fuzzy Hash: 4F41F5B1D00618CFDF24DF99C8847DEBBB5BF88308F60816AD418AB251DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C73E00, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C75649

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7d20178428edda55edea887c6b2aeb81b0420692738100182c68a2b3c46f429a
Instruction ID: 4bf6545b8bde0b55d77f2c937c64c71526d3923ff07ce14113122414ae4090ea
Opcode Fuzzy Hash: 7d20178428edda55edea887c6b2aeb81b0420692738100182c68a2b3c46f429a
Instruction Fuzzy Hash: DF41D471D00718CBDF24DF99C884BDEBBB5BF89304F608069D419AB251DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C7AFFC, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C7B9B6,?,?,?,?,?), ref: 00C7BA77

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 503a2962e083a54434a6500db868c77a7c7617d7de43284539b7d4ca2b51105a
Instruction ID: ff07bd07d06e53c80ba822cf2d371d79f04e32f52a448ac18b6740abc4c28382
Opcode Fuzzy Hash: 503a2962e083a54434a6500db868c77a7c7617d7de43284539b7d4ca2b51105a
Instruction Fuzzy Hash: 7E21E6B5900248DFDB10CFAAD584BDEBBF4FB48324F14801AE918A7310D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C79930, Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C79791,00000800,00000000,00000000), ref: 00C799A2

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dfb6a1f150adf6d5344c2c5851d2f13fccab070c5b2891845a4a5e12821046e3
Instruction ID: 26374dbb76be0d8f0be54fc58b6ee4cb688131f3d1a8d7e9153e49b496d67577
Opcode Fuzzy Hash: dfb6a1f150adf6d5344c2c5851d2f13fccab070c5b2891845a4a5e12821046e3
Instruction Fuzzy Hash: BA2138B6D002098FDB10CF9AD444ADEFBF4FB88324F10852ED528A7600C7756949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B9E8, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C7B9B6,?,?,?,?,?), ref: 00C7BA77

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed4e1d35e2e4397649ffe9919babb3bfc9def6b7fc1551fd1c964e14da0d8220
Instruction ID: 62867fde30d3f70795cc3b4998d4549a5044efa53229e7de463cf474a0bf94bd
Opcode Fuzzy Hash: ed4e1d35e2e4397649ffe9919babb3bfc9def6b7fc1551fd1c964e14da0d8220
Instruction Fuzzy Hash: 8A2103B5D002489FDB10CFAAD984ADEBBF4EB48320F14841AE918A7210C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C78F28, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C79791,00000800,00000000,00000000), ref: 00C799A2

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5ec31a361f330bb4bc74dd6f3ffb6aaf6826845cccec06265d8baad32b8a235e
Instruction ID: b7979170231ac664b52cbe4eae55c12ec048580f1ee61fa47e4a7889f9fcbc0d
Opcode Fuzzy Hash: 5ec31a361f330bb4bc74dd6f3ffb6aaf6826845cccec06265d8baad32b8a235e
Instruction Fuzzy Hash: 7111E4B69002499FDB10CF9AD444ADEFBF4EB88314F15842EE929A7600C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C796B0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C79716

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5206e17459f01838c5dff92bef35de2a850818a850bec1fad40041c1ed7dc0e5
Instruction ID: 17db9e6209e2f3279be876b5eee64d2256bee20f8a27e4a5d05036fd73dc3125
Opcode Fuzzy Hash: 5206e17459f01838c5dff92bef35de2a850818a850bec1fad40041c1ed7dc0e5
Instruction Fuzzy Hash: A411DFB6D006498FDB14CF9AC484ADEFBF4EF88324F15855AD429B7600C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075E0AE8, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.335894078.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15986cb719b7c4610af9ee7a39f735e75df5f58824bc14de6a54db74f968441b
Instruction ID: 7ae36040af203a17a82e90c08bb19f6fb1e2cdc4d7cb57e8fc36eb9ad6b0bf1b
Opcode Fuzzy Hash: 15986cb719b7c4610af9ee7a39f735e75df5f58824bc14de6a54db74f968441b
Instruction Fuzzy Hash: B9411FB4D1921ADBDB18CBA4D4507FDBBBCFB0A258F205816D499F3290D7B49D41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 075E0AF8, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.335894078.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a69507559a39e7594e7f088d9b9eac7973955267d8ce79186689733063a8cd
Instruction ID: 85090913b66216bb2fbbc4e04c3b1a3820aea3a36bd405ee091f29ef63fa9050
Opcode Fuzzy Hash: 40a69507559a39e7594e7f088d9b9eac7973955267d8ce79186689733063a8cd
Instruction Fuzzy Hash: 7C4120B4D1921EDBDB18CFA5D4407FEB7BCBB4A248F205826D499F3290D7B49D41CA50

Uniqueness

Uniqueness Score: -1.00%

Function 075E0C3C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.335894078.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55192393606ff5a783a308157c6ce66e3d338b7dbe3a6a4f6b323e7ab0bc8959
Instruction ID: 6a111a851a57f6b3bc602b707250fba83a2c01607a8816cea48851284864a5af
Opcode Fuzzy Hash: 55192393606ff5a783a308157c6ce66e3d338b7dbe3a6a4f6b323e7ab0bc8959
Instruction Fuzzy Hash: 622153F1D1A219DBDB18CBA4D8506EDB7BCFB4A244F205856D48AF7290E7B09D00CB10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 075E1388, Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.335894078.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86a9ea00ff1006c8ddab90c10ab6c4efdf69c1422fc6b3cb66abef9f64eb467
Instruction ID: 23b97b5a210829366eab4783e6cfd81f4834f00b270e17d89ae6e4e2966f6398
Opcode Fuzzy Hash: d86a9ea00ff1006c8ddab90c10ab6c4efdf69c1422fc6b3cb66abef9f64eb467
Instruction Fuzzy Hash: 8ED18CB1B006098FEB19DB75C4507AEB7EABF89700F14886EE14ADB291DF34E905CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C7E2B0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20234ebece31e6c21f8e5726298af44a78bc0a681192178dd48bfa440404db55
Instruction ID: 1fd1d48eca72338f3758d75b1dc25b5ba8c12a27892438e418f40bad23dbfaa7
Opcode Fuzzy Hash: 20234ebece31e6c21f8e5726298af44a78bc0a681192178dd48bfa440404db55
Instruction Fuzzy Hash: DF12B3B1592746BAD310CF65F9B86893B61F7C1328B50420ADA611ABF1D7BC294BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C7C30C, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2788d77f56939c27d019893699342b42c632a3c82cf07273814beb4fcaf2024
Instruction ID: 9a91e97783612a5bd1e0af97faa3522e0915610a641790811f8fe0987a02bb87
Opcode Fuzzy Hash: f2788d77f56939c27d019893699342b42c632a3c82cf07273814beb4fcaf2024
Instruction Fuzzy Hash: 73A14E32E0021A8FCF15DFB5C8845DEB7B2FF85300B15C56AE91ABB261DB35A945DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C7E2AA, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.327619546.0000000000C70000.00000040.00000001.sdmp, Offset: 00C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f445fdc43dc0d1b2f57e8600ecbd2f7ff5cac0966335f6ed196b07fc7f8fa362
Instruction ID: 79372090061c90446a2d3645c16ac3e64b6e0b493f8cd09ee9a5c44f7a4e57ce
Opcode Fuzzy Hash: f445fdc43dc0d1b2f57e8600ecbd2f7ff5cac0966335f6ed196b07fc7f8fa362
Instruction Fuzzy Hash: 2DC105B1952746BAD710CF65F9B86893B71FBC5328B60420AD9612B7E0D7BC284BCF44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Inquiry_10_05_2021,pdf.exe PID: 576 Parent PID: 1560 Inquiry_10_05_2021,pdf.exeCOMMON

Executed Functions

Function 00418260, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418260(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DB0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d42
				_t12 =  &_a8; // 0x413d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418263
0x0041826f
0x00418277
0x00418282
0x0041829d
0x004182a5
0x004182a9

APIs

NtReadFile.NTDLL(B=A,5E972F59,FFFFFFFF,00413A01,?,?,B=A,?,00413A01,FFFFFFFF,5E972F59,00413D42,?,00000000), ref: 004182A5

Strings

B=A, xrefs: 0041829D, 004182A4
B=A, xrefs: 00418282, 00418290

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: B=A$B=A
API String ID: 2738559852-2767357659
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 36fb0ef1660234b95adbc5e615de389476f61a426637268b67c73261640a8fd9
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 2AF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B10, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B10(void* __ebx, void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_v8 =  &_v536;
				_t15 = E0041AB40( &_v12, 0x104, _a8);
				_t32 = _t31 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF60(__eflags, _v8);
					_t33 = _t32 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1E0(__ebx,  &_v12, 0);
						_t33 = _t33 + 8;
					}
					_t18 = E004192F0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b2c
0x00409b2f
0x00409b34
0x00409b39
0x00409b43
0x00409b48
0x00409b4b
0x00409b4d
0x00409b55
0x00409b5a
0x00409b5a
0x00409b61
0x00409b69
0x00409b6c
0x00409b6e
0x00409b82
0x00000000
0x00409b84
0x00409b8a
0x00409b3e
0x00409b3e
0x00409b3e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B82

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 046ff59bb8e44ad8641c0e43070f5aeaf3db9792b4ffc4f87dfb9ba9f6fb7e9c
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: D70112B5D4010DB7DF10EAE5DC42FDEB378AB54318F1041A5E908A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181B0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				void* _t17;
				long _t21;
				long _t27;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DB0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t27 = _a48;
				_t17 = _a44;
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _t17, _t27); // executed
				return _t21;
			}

0x004181bf
0x004181c7
0x004181cc
0x004181cf
0x004181fd
0x00418201

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 1505d2c2fac7169f29cf6ab97caa2a59105c471fc85729d0552dd22f4c6ed161
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: D7F0B6B2200208ABCB48CF89DC85DEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004182DA, Relevance: 1.5, APIs: 1, Instructions: 36
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004182DA(void* __eax, void* _a4, void* _a8, void* _a12, void* _a16, void* _a20) {
				intOrPtr _v55;
				void* _t10;

				asm("sbb al, 0x5b");
				_t10 = __eax - _v55;
				if (_t10 >= 0) goto L3;
			}

0x004182da
0x004182dc
0x004182df

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a3daaf078b7ca833133ce3e035bbef7ce657acb3770b0cd24c1b6a2fa2f45b19
Instruction ID: 6139a172401e0b6bfc943a0251530c190a18f8d98c3f3e6cee21849eb26e46c5
Opcode Fuzzy Hash: a3daaf078b7ca833133ce3e035bbef7ce657acb3770b0cd24c1b6a2fa2f45b19
Instruction Fuzzy Hash: A1F05E76200214AFDB10EF98EC80EEB77A9EF88750F148559FA189B241C630EA118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 004181AA, Relevance: 1.5, APIs: 1, Instructions: 33
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004181AA(void* __esi, void* __eflags, long _a4, HANDLE* _a12, long _a16, struct _EXCEPTION_RECORD _a20, struct _ERESOURCE_LITE _a24, struct _GUID _a28, long _a32, long _a36, long _a40, long _a44, void* _a48) {
				void* __ebp;
				void* _t15;

				asm("xlatb");
				if(__eflags != 0) {
					return _t15;
				} else {
					if(__eflags <= 0) {
						__esi = __esi - 1;
						__eflags = __esi;
						__ebp = __esp;
						__eax = _a4;
						_push(__esi);
						_t3 = __eax + 0xc40; // 0xc40
						__esi = _t3;
						E00418DB0(__edi, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28) = _a44;
					}
					__esp = __esp + 0x14;
					_a36 = _a24;
					__eax = _a12;
					__eax = NtCreateFile(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a12, _a16); // executed
					_pop(__esi);
					return __eax;
				}
			}

0x004181aa
0x004181ab
0x004181a9
0x004181ad
0x004181ad
0x004181af
0x004181af
0x004181b1
0x004181b3
0x004181b9
0x004181bf
0x004181bf
0x004181cf
0x004181cf
0x004181d5
0x004181e9
0x004181f5
0x004181fd
0x004181ff
0x00418201
0x00418201

APIs

NtCreateFile.NTDLL(00000060,00408AE3,?,00413B87,00408AE3,FFFFFFFF,?,?,FFFFFFFF,00408AE3,00413B87,?,00408AE3,00000060,00000000,00000000), ref: 004181FD

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d5ab14c4ad75129ae44f11daaefdbbf82298f557f787b086f0e786d0f5d8979b
Instruction ID: 78969520041bed1203aeaf83b2857a416025afc906d07f232de719120c6250f2
Opcode Fuzzy Hash: d5ab14c4ad75129ae44f11daaefdbbf82298f557f787b086f0e786d0f5d8979b
Instruction Fuzzy Hash: E0F098B2214409AB8B04DF8CDD80DEB73ADEB8C354B05820DFA1DD3201D634E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418390, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418390(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DB0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041839f
0x004183a7
0x004183c9
0x004183cd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F84,?,00000000,?,00003000,00000040,00000000,00000000,00408AE3), ref: 004183C9

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c1f36b05bbd4b7963809c3793a6f2df241a2ee7dc34c60eca979b2d1d68cf477
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1DF015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241CA30F810CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 004182E0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00413D20,?,?,00413D20,00408AE3,FFFFFFFF), ref: 00418305

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: 2c2b34aedc846ab3ae484734a1171ee081eb0df99b6426d3cac892bcac86a451
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 7CD012752003146BD710EF99DC45ED7775CEF44750F154459BA185B242C930F90086E4

Uniqueness

Uniqueness Score: -1.00%

Function 01309910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130991A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ab45ba730c31f6730565f6361b3b5bc5a15cc66223aa17b94cc4d591747a1440
Instruction ID: 4935cff62c0d82f4e51dbd3bce572dc85b56fb538f9ac060f89cef0604d00e2e
Opcode Fuzzy Hash: ab45ba730c31f6730565f6361b3b5bc5a15cc66223aa17b94cc4d591747a1440
Instruction Fuzzy Hash: B59002B520101402D544719944087460405A7D1345F51C421A5054554EC6998DE976A5

Uniqueness

Uniqueness Score: -1.00%

Function 013099A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013099AA

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8e238b7b305a7d27610656a67559fc5053596cb7487b0d723fa28590ac2d97a7
Instruction ID: c9471c65e6e8de01020d064b801053794dc4009ec935e558bd2104258e15336a
Opcode Fuzzy Hash: 8e238b7b305a7d27610656a67559fc5053596cb7487b0d723fa28590ac2d97a7
Instruction Fuzzy Hash: B09002A534101442D50461994418B060405E7E2345F51C425E1054554DC659CC667166

Uniqueness

Uniqueness Score: -1.00%

Function 01309860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130986A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9e8cd7e671dada42f699ebf01746dac9fce5b2867d479b45a68595a1e9d00b6e
Instruction ID: ecf3e0788161dce5c1d54887323297376642b264a466029f50d11e28135d75bd
Opcode Fuzzy Hash: 9e8cd7e671dada42f699ebf01746dac9fce5b2867d479b45a68595a1e9d00b6e
Instruction Fuzzy Hash: D690027520101413D515619945087070409A7D1385F91C822A0414558DD6968966B161

Uniqueness

Uniqueness Score: -1.00%

Function 01309840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130984A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b43e966779c4978ef7e6a3097ccf941a5adaf7749c10b162a7de40974ca04ff8
Instruction ID: da4f58e1cb56ed39cfb257d3e26916432b76b5695d0d00ae007912033f8ef272
Opcode Fuzzy Hash: b43e966779c4978ef7e6a3097ccf941a5adaf7749c10b162a7de40974ca04ff8
Instruction Fuzzy Hash: B9900265242051529949B19944085074406B7E1385791C422A1404950CC566986AE661

Uniqueness

Uniqueness Score: -1.00%

Function 013098F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013098FA

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bb265aeaac6c69a3be3d43aee3b85a3b96c9560c42e539d8015657b00b813be2
Instruction ID: 770f924125ce15a41c92fffb5d3af0c94e85fd906fd83fc06f68f4384783e142
Opcode Fuzzy Hash: bb265aeaac6c69a3be3d43aee3b85a3b96c9560c42e539d8015657b00b813be2
Instruction Fuzzy Hash: 0790026560101502D50571994408616040AA7D1385F91C432A1014555ECA6589A6B171

Uniqueness

Uniqueness Score: -1.00%

Function 01309A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01309A2A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bb92479ac3519fcc902f1095b50a700f16586d8eb5fa863f727639a93febff98
Instruction ID: f7fbc8b2e56b04014338f5246fd7812deed6cf5b1d3d680267d15a836d4f61ad
Opcode Fuzzy Hash: bb92479ac3519fcc902f1095b50a700f16586d8eb5fa863f727639a93febff98
Instruction Fuzzy Hash: 9B90026560101042854471A988489064405BBE2355751C531A0988550DC599887966A5

Uniqueness

Uniqueness Score: -1.00%

Function 01309A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01309A0A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 27cca0cdf5b2e5f71c3452811acad3e94db56f8f641ed07cdc9c13a8f81d275c
Instruction ID: 10d58bfe2a335f36574a22a6bf7f1ed556a5bb44e3a020be838e1c251337b78a
Opcode Fuzzy Hash: 27cca0cdf5b2e5f71c3452811acad3e94db56f8f641ed07cdc9c13a8f81d275c
Instruction Fuzzy Hash: 7C90027520141402D5046199481870B0405A7D1346F51C421A1154555DC665886575B1

Uniqueness

Uniqueness Score: -1.00%

Function 01309A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01309A5A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 108b334eda297416109b666c3af08ed069c1af36a79b0e3160c27d5bd35484f7
Instruction ID: 640d80eab98b7a5b4424fdae78683efac084a6d2020a9ad3ea913f4d5d49ded2
Opcode Fuzzy Hash: 108b334eda297416109b666c3af08ed069c1af36a79b0e3160c27d5bd35484f7
Instruction Fuzzy Hash: 7590026521181042D60465A94C18B070405A7D1347F51C525A0144554CC95588756561

Uniqueness

Uniqueness Score: -1.00%

Function 01309540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130954A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1268d9a620011ef2b6355f517d64872cfec363137e1fc995458878ec4bfab17e
Instruction ID: d2ff1311c5012e7e5124ed1e515783ed012ebbb8b9c0029d0c961e5b377699c6
Opcode Fuzzy Hash: 1268d9a620011ef2b6355f517d64872cfec363137e1fc995458878ec4bfab17e
Instruction Fuzzy Hash: C2900269211010034509A59907085070446A7D6395351C431F1005550CD66188756161

Uniqueness

Uniqueness Score: -1.00%

Function 013095D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013095DA

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4aed993f579bbef05ae86ac073da23a825a2158fb813128a00732a68537d4d8b
Instruction ID: 5ced99b8795b7791aa4775b72501d7ed1f61858d68bc2f6bd04966312a08aa84
Opcode Fuzzy Hash: 4aed993f579bbef05ae86ac073da23a825a2158fb813128a00732a68537d4d8b
Instruction Fuzzy Hash: 119002A520201003850971994418616440AA7E1345B51C431E1004590DC56588A57165

Uniqueness

Uniqueness Score: -1.00%

Function 01309710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130971A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 781efb220e11c4440a0dbbf00eb5cc57ec73f8872ed9625f1c96c8ce856f8a76
Instruction ID: 50783b5418e46876434d1b56449dfbbf83d5b8a342ae0e0bb01ff8fb360e0f01
Opcode Fuzzy Hash: 781efb220e11c4440a0dbbf00eb5cc57ec73f8872ed9625f1c96c8ce856f8a76
Instruction Fuzzy Hash: 1890027520101402D50465D9540C6460405A7E1345F51D421A5014555EC6A588A57171

Uniqueness

Uniqueness Score: -1.00%

Function 013097A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013097AA

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d82197ad8ddcef329342bcc0e2c2d88023282c850eb06103ae29ca16ea3835fc
Instruction ID: 609e1568ce0a2cedff4256c9c1cb17e40a344e1b1a881603840df8ef429e3a8a
Opcode Fuzzy Hash: d82197ad8ddcef329342bcc0e2c2d88023282c850eb06103ae29ca16ea3835fc
Instruction Fuzzy Hash: 0E90026530101003D5447199541C6064405F7E2345F51D421E0404554CD955886A6262

Uniqueness

Uniqueness Score: -1.00%

Function 01309780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130978A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0a1ff2301e0154ab56922d3c15fa419b2785f8c8ad48b408f5603a8903aa3735
Instruction ID: 0f8db3cdaecb84cda6a2991bb57641b8617a19b83743b9fc5247ddf976638637
Opcode Fuzzy Hash: 0a1ff2301e0154ab56922d3c15fa419b2785f8c8ad48b408f5603a8903aa3735
Instruction Fuzzy Hash: 4490026D21301002D5847199540C60A0405A7D2346F91D825A0005558CC955887D6361

Uniqueness

Uniqueness Score: -1.00%

Function 01309FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01309FEA

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bdef3ba1d55ff5cb334661d08aa6d76b7cda4a9176af07e4136585b1f41044c6
Instruction ID: 76b3d1ec92602afa6cc31e2d3024451f7bb3871937814d0e2c1cfb9865b68fc5
Opcode Fuzzy Hash: bdef3ba1d55ff5cb334661d08aa6d76b7cda4a9176af07e4136585b1f41044c6
Instruction Fuzzy Hash: 5690027531115402D514619984087060405A7D2345F51C821A0814558DC6D588A57162

Uniqueness

Uniqueness Score: -1.00%

Function 01309660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0130966A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3809fa3a08659f36797bad978c2bdc5a5b3feefc11f922c2f9af2199c50c57ce
Instruction ID: f1aaae4b251fd128faa08e02ddf29b3756141bda1435a690caa38b0067dff4d2
Opcode Fuzzy Hash: 3809fa3a08659f36797bad978c2bdc5a5b3feefc11f922c2f9af2199c50c57ce
Instruction Fuzzy Hash: 3A90027520101802D5847199440864A0405A7D2345F91C425A0015654DCA558A6D77E1

Uniqueness

Uniqueness Score: -1.00%

Function 013096E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013096EA

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d71ec65ce84dca68444f1c874d65a96381d7642b89c0b117ba5dade106ae539
Instruction ID: 1969cbcc8e18bb81fb26a6ad11b84510f144fe977bdf5a56f09e86b686002dee
Opcode Fuzzy Hash: 2d71ec65ce84dca68444f1c874d65a96381d7642b89c0b117ba5dade106ae539
Instruction Fuzzy Hash: 8490027520109802D5146199840874A0405A7D1345F55C821A4414658DC6D588A57161

Uniqueness

Uniqueness Score: -1.00%

Function 004088A0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
Instruction ID: 5568bf364e599ab98db8d6cec98c55b42aa716c8f34da205b899e6f8c2a7a87e
Opcode Fuzzy Hash: 283bf2c7f344e97b91bcc60d13a5b0e411dcd70c841c71c3deed8c9853ae10d6
Instruction Fuzzy Hash: EF213CB2C4420857CB20E6649D42BFF73BC9B50304F44057FE989A3181F638BB498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00418446, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00418446(intOrPtr __eax, void* __edi, void* _a4, void* _a8, void* _a12) {

				asm("xlatb");
				 *0x642c23b1 = __eax;
				if (__edi - 0x31 > 0) goto L3;
			}

0x00418449
0x0041844a
0x0041844f

APIs

RtlAllocateHeap.NTDLL(00413506,?,00413C7F,00413C7F,?,00413506,?,?,?,?,?,00000000,00408AE3,?), ref: 004184AD

Strings

hA, xrefs: 0041846C, 00418477

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: hA
API String ID: 1279760036-1221461045
Opcode ID: ef07a568ac8bbcf0d3657dfe2f105c3164f74fbf392ed9d8499c06b2ed10b1e3
Instruction ID: dc5cfa27bc92d6c3bb25a621edd63e2758f1237e4b5122244fd45afae69b1cd4
Opcode Fuzzy Hash: ef07a568ac8bbcf0d3657dfe2f105c3164f74fbf392ed9d8499c06b2ed10b1e3
Instruction Fuzzy Hash: 3BF08CB26043106BDB24EF98DC84EEB736DEF84390F10445AFA485B241D931E904C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 004184B2, Relevance: 3.1, APIs: 2, Instructions: 70
processmemoryCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004184B2(void* __ebx, void* __esi, void* __eflags, void* _a4, long _a8, void* _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52) {
				intOrPtr _v0;
				char _v3;
				intOrPtr _t26;
				intOrPtr _t27;
				void* _t29;
				char _t33;
				intOrPtr _t44;
				void* _t49;
				intOrPtr* _t52;
				void* _t56;

				asm("cli");
				if(__eflags >= 0) {
					_t23 = _a4;
					_t10 = _t23 + 0xc80; // 0x8bec97d5
					_t52 = _t10;
					E00418DB0(_t49, _a4, _t52,  *((intOrPtr*)(_a4 + 0xa14)), 0, 0x37);
					_t26 = _a36;
					_t44 = _a28;
					_t27 = _a24;
					__eflags =  &_v3;
					asm("sbb al, 0x51");
					_t29 =  *((intOrPtr*)( *_t52))(_a8, _a12, _a16, _a20, _t27, _t44, _t26, _a40, _a44, _a48, _a52, __esi, _t56); // executed
					return _t29;
				} else {
					_push(0x8b558182);
					_push(_t56);
					_t30 = _v0;
					_push(__esi);
					_t4 = _t30 + 0xc74; // 0xc74
					E00418DB0(0xb3b5a8b9, _v0, _t4,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x35);
					_t33 = RtlFreeHeap(_a4, _a8, _a12); // executed
					return _t33;
				}
			}

0x004184b2
0x004184b3
0x00418533
0x00418542
0x00418542
0x0041854a
0x00418560
0x00418568
0x0041856c
0x0041856d
0x0041856e
0x00418584
0x00418588
0x004184b5
0x004184bd
0x004184c0
0x004184c3
0x004184c9
0x004184cf
0x004184d7
0x004184ed
0x004184f1
0x004184f1

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED
CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,y@,?,?,?), ref: 00418584

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFreeHeapInternalProcess
String ID:
API String ID: 1438695366-0
Opcode ID: 4d703ab658ba21b1064eba8c8032abbb217280a2b8c5da063c7b2e11d205b546
Instruction ID: 4c26110982e54e33908c75919cddff1711db29b15eae7b1de9a814863582b7ef
Opcode Fuzzy Hash: 4d703ab658ba21b1064eba8c8032abbb217280a2b8c5da063c7b2e11d205b546
Instruction Fuzzy Hash: 0911F9B2210208BFDB14DF99DC85EEB77ADAF8C354F158259FA0D97241C630E951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004184F2, Relevance: 3.0, APIs: 2, Instructions: 34
processCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004184F2(void* __eax, void* __ecx, void* __eflags) {
				intOrPtr _t10;
				void* _t12;
				intOrPtr _t17;
				void* _t21;
				void* _t24;
				void* _t25;

				asm("adc al, 0x59");
				if(__eflags == 0) {
					_t22 = __eax + 0xc7c;
					E00418DB0(_t21, __eax, __eax + 0xc7c, __ecx, 0, 0x36);
					ExitProcess( *(_t24 + 0xc));
				}
				_t17 =  *((intOrPtr*)(_t24 + 0x20));
				_t10 =  *((intOrPtr*)(_t24 + 0x1c));
				_t25 = _t24 + 1;
				asm("sbb al, 0x51");
				_t12 =  *((intOrPtr*)( *_t22))( *((intOrPtr*)(_t25 + 0xc)),  *((intOrPtr*)(_t25 + 0x10)),  *((intOrPtr*)(_t25 + 0x14)),  *((intOrPtr*)(_t25 + 0x18)), _t10, _t17, __eax); // executed
				return _t12;
			}

0x004184f2
0x004184f4
0x00418512
0x0041851a
0x00418528
0x00418528
0x00418568
0x0041856c
0x0041856d
0x0041856e
0x00418584
0x00418588

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418528
CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,y@,?,?,?), ref: 00418584

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Process$CreateExitInternal
String ID:
API String ID: 4273315900-0
Opcode ID: 868c5dcbd07d2c4d49c012475ad494f2cd898b0f99345c713dcf96ab50a3015d
Instruction ID: 462253f85ee59e02bb8fcadd2d2326705f9368a32f61f26b283835965c256d33
Opcode Fuzzy Hash: 868c5dcbd07d2c4d49c012475ad494f2cd898b0f99345c713dcf96ab50a3015d
Instruction Fuzzy Hash: 89F0F8B2200104BFDB14DF98DC80EEB73ADEF8C750F21860DBA1C97240CA34E9528BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00407260(void* __ebx, void* __ecx, void* __eflags, intOrPtr _a4, long _a8, intOrPtr _a57327689) {
				char _v67;
				char _v68;
				void* _t14;
				intOrPtr* _t15;
				int _t16;
				void* _t20;
				long _t24;
				intOrPtr* _t28;
				void* _t29;
				void* _t33;

				_t33 = __eflags;
				_t20 = __ecx;
				_v68 = 0;
				E00419D10( &_v67, 0, 0x3f);
				_a57327689 = _a57327689 + _t20;
				_push(_t20);
				E0041A8F0();
				_t14 = E00409B10(__ebx, _t33, _a4 + 0x1c,  &_v68); // executed
				_t15 = E00413E20(_a4 + 0x1c, _t14, 0, 0, 0xc4e7b6d6);
				_t28 = _t15;
				if(_t28 != 0) {
					_t24 = _a8;
					_t16 = PostThreadMessageW(_t24, 0x111, 0, 0); // executed
					if(_t16 == 0) {
						_t16 =  *_t28(_t24, 0x8003, _t29 + (E00409270(1, 8) & 0x000000ff) - 0x40, _t16);
					}
					return _t16;
				}
				return _t15;
			}

0x00407260
0x00407260
0x0040726f
0x00407273
0x00407277
0x0040727d
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 205fda5ff18a58da29b4ee771503f4b4c431d8485573b34ca04b666bda837a67
Instruction ID: ed9c0dd32f68776d22a62b6ccf8dda9c2c93357863a303a75fe51d199eec68b3
Opcode Fuzzy Hash: 205fda5ff18a58da29b4ee771503f4b4c431d8485573b34ca04b666bda837a67
Instruction Fuzzy Hash: DE018431A8032876E720A6959C03FFE776C5B40B55F15416EFF04BA1C2E6A87D0646EA

Uniqueness

Uniqueness Score: -1.00%

Function 004185C5, Relevance: 1.6, APIs: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,y@,?,?,?), ref: 00418584

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 51470fe23f0cdfee22a547388c6b8e1a8247a0f42e60b8ec8d3aac2ebe22cc48
Instruction ID: e53eeafdeaac5be1abaaf558dbe29df86c97c2ad8106ea6acda200e5fec9d54f
Opcode Fuzzy Hash: 51470fe23f0cdfee22a547388c6b8e1a8247a0f42e60b8ec8d3aac2ebe22cc48
Instruction Fuzzy Hash: 8101DAB6200208BFDB14DF99DC81EEB77ADEF8C750F108559FA5C97241CA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407206, Relevance: 1.5, APIs: 1, Instructions: 48
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00407206(void* __eflags, intOrPtr* _a4, intOrPtr _a8, long _a12, intOrPtr _a57327693) {
				char _v64;
				void* _t12;
				int _t13;
				void* _t21;
				void* _t22;
				void* _t24;
				long _t28;
				int _t32;
				void* _t34;

				asm("adc al, 0x77");
				if(__eflags > 0) {
					_a57327693 = _a57327693 + _t22;
					_push(_t22);
					E0041A8F0();
					_t12 = E00409B10(_t21, __eflags, _a8 + 0x1c,  &_v64); // executed
					_t13 = E00413E20(_a8 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
					_t32 = _t13;
					__eflags = _t32;
					if(_t32 != 0) {
						_t28 = _a12;
						_t13 = PostThreadMessageW(_t28, 0x111, 0, 0); // executed
						__eflags = _t13;
						if(_t13 == 0) {
							_t13 =  *_t32(_t28, 0x8003, _t34 + (E00409270(1, 8) & 0x000000ff) - 0x40, _t13);
						}
					}
					return _t13;
				} else {
					_push(_t34);
					_t24 = E004195C0(_t22);
					if(_t24 == 0 || _t24 == 0x33333333) {
						__eflags = 0;
						return 0;
					} else {
						return  *_a4 + _t24;
					}
				}
			}

0x00407206
0x00407208
0x00407277
0x0040727d
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072a8
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x004072dd
0x004072e2
0x0040720a
0x00407210
0x00407218
0x0040721c
0x0040722f
0x00407232
0x00407226
0x0040722e
0x0040722e
0x0040721c

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 7461327ca472f73772ee0c7d2f6fe208f2fb5bb45eb805c6cdd30b4da6b54e1d
Instruction ID: 0759a2ec85ded8d69395a1c64b6a36d62cddc8d75783b6b2566bfd242a08df81
Opcode Fuzzy Hash: 7461327ca472f73772ee0c7d2f6fe208f2fb5bb45eb805c6cdd30b4da6b54e1d
Instruction Fuzzy Hash: 29F0F931E802143ADB206A655C02FFF77185B41B14F15445EFE04BE1C2D5AD7D1646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041852E, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,y@,?,?,?), ref: 00418584

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: f0de5ffa370472cc6288d52f84a60565cbf8295506ce33664ebc8903052dc0bc
Instruction ID: 3ec000304e50cc62af5877de30f39d80894ac438792675187893634b120d6613
Opcode Fuzzy Hash: f0de5ffa370472cc6288d52f84a60565cbf8295506ce33664ebc8903052dc0bc
Instruction Fuzzy Hash: 8601FDB2204109ABCB44CF8DDC80DEB77AEAF8C314F25825DFA4D97242C634E8418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418530, Relevance: 1.5, APIs: 1, Instructions: 42
processCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00418530(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52) {
				void* _v3;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t22;
				intOrPtr _t30;
				void* _t33;
				intOrPtr* _t34;

				_t3 = _a4 + 0xc80; // 0x8bec97d5
				_t34 = _t3;
				E00418DB0(_t33, _a4, _t34,  *((intOrPtr*)(_t16 + 0xa14)), 0, 0x37);
				_t19 = _a36;
				_t30 = _a28;
				_t20 = _a24;
				asm("sbb al, 0x51");
				_t22 =  *((intOrPtr*)( *_t34))(_a8, _a12, _a16, _a20, _t20, _t30, _t19, _a40, _a44, _a48, _a52); // executed
				return _t22;
			}

0x00418542
0x00418542
0x0041854a
0x00418560
0x00418568
0x0041856c
0x0041856e
0x00418584
0x00418588

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,y@,?,?,?), ref: 00418584

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: a8d03338a5b8e7428a3411fecad22ab56c063a2c8b97b146bea9412fcdabe5ed
Instruction ID: 513559d71bb74bdb0002c37f9039ea76381332b5628ed031e04d017542a4cadc
Opcode Fuzzy Hash: a8d03338a5b8e7428a3411fecad22ab56c063a2c8b97b146bea9412fcdabe5ed
Instruction Fuzzy Hash: A3015FB2214208ABCB54DF89DC81EEB77ADAF8C754F158258BA0D97251DA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004184C0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184C0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DB0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184cf
0x004184d7
0x004184ed
0x004184f1

APIs

RtlFreeHeap.NTDLL(00000060,00408AE3,?,?,00408AE3,00000060,00000000,00000000,?,?,00408AE3,?,00000000), ref: 004184ED

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: bd69bb0d8e56be58ea846d441575552e1355d89f45fa104c15060bc9e05e818a
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: EDE01AB12002046BDB14DF59DC45EE777ACAF88750F014559BA0857241CA30E9108AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418480, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00418480(intOrPtr _a4, void* _a8, intOrPtr _a12, void* _a16) {
				intOrPtr _t9;
				void* _t10;
				void* _t12;
				void* _t15;

				E00418DB0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t9 = _a12;
				_t12 = _a8;
				asm("les edx, [edx+edx*2]");
				_push(_t9);
				_t10 = RtlAllocateHeap(_t12); // executed
				return _t10;
			}

0x00418497
0x0041849f
0x004184a2
0x004184a6
0x004184ab
0x004184ad
0x004184b1

APIs

RtlAllocateHeap.NTDLL(00413506,?,00413C7F,00413C7F,?,00413506,?,?,?,?,?,00000000,00408AE3,?), ref: 004184AD

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 95874ba5a5537b3d16e5bdcad340c4ef7a657c48911e570d945e23b5f838c0ed
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 7BE012B1200208ABDB14EF99DC41EE777ACAF88654F118559BA085B282CA30F9108AF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418620, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418620(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E00418DB0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041863a
0x00418650
0x00418654

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CF92,0040CF92,00000041,00000000,?,00408B55), ref: 00418650

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 1821f594b7a2fedb3326d3670d224aab122327744fc2f581a2e4424e2d02315d
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 2AE01AB12002086BDB10DF49DC85EE737ADAF89650F018159BA0857241C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418500, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418500(intOrPtr _a4, int _a8) {
				intOrPtr _t8;
				void* _t10;

				_t5 = _a4;
				_t8 =  *((intOrPtr*)(_a4 + 0xa14));
				E00418DB0(_t10, _t5, _t5 + 0xc7c, _t8, 0, 0x36);
				ExitProcess(_a8);
			}

0x00418503
0x00418506
0x0041851a
0x00418528

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418528

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 9f62bdc44f65d7d9a2483e28fb075f3ff631dd5cfbab79109080827007e6cc43
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 62D012716003147BD620DF99DC85FD7779CDF49750F018069BA1C5B241C931BA0086E5

Uniqueness

Uniqueness Score: -1.00%

Function 004184F9, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004184F9(int _a8) {
				intOrPtr _t9;
				void* _t11;

				asm("adc esi, [0x558fc8c3]");
				_t5 = _a8;
				_t9 =  *((intOrPtr*)(_a8 + 0xa14));
				E00418DB0(_t11, _t5, _t5 + 0xc7c, _t9, 0, 0x36);
				ExitProcess(_a8);
			}

0x004184fa
0x00418503
0x00418506
0x0041851a
0x00418528

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418528

Memory Dump Source

Source File: 0000000D.00000002.392435826.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4433c58c9ad5b3ddc074846c3122e260f22d08ae378467dda185a9eb3183c5b1
Instruction ID: 7e3685289a6ae6d128e77e16f9486eb72cb277db1207faf211c42ad0191ee468
Opcode Fuzzy Hash: 4433c58c9ad5b3ddc074846c3122e260f22d08ae378467dda185a9eb3183c5b1
Instruction Fuzzy Hash: 4AE012756103147BD620DF54CC85FD737A8DF49750F158059BE586B381C935BA05CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 0130967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01309694

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 87bc257be6869c6e75247f8f71785c2d832cf8b870735d2748443ebee3dc4fe8
Instruction ID: 03f95bed409d2391035d7022dfed3e44ee075b89d0461e7556e859117b60b546
Opcode Fuzzy Hash: 87bc257be6869c6e75247f8f71785c2d832cf8b870735d2748443ebee3dc4fe8
Instruction Fuzzy Hash: ABB02B718010C4C6DA02D3A00A0C7173D0077C0318F12C061D1020240F8338C090F2B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0137B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** Resource timeout (%p) in %ws:%s, xrefs: 0137B352
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0137B2F3
write to, xrefs: 0137B4A6
read from, xrefs: 0137B4AD, 0137B4B2
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0137B2DC
*** enter .exr %p for the exception record, xrefs: 0137B4F1
Go determine why that thread has not released the critical section., xrefs: 0137B3C5
*** Inpage error in %ws:%s, xrefs: 0137B418
a NULL pointer, xrefs: 0137B4E0
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0137B3D6
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0137B323
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0137B314
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0137B476
The instruction at %p tried to %s , xrefs: 0137B4B6
The resource is owned exclusively by thread %p, xrefs: 0137B374
*** An Access Violation occurred in %ws:%s, xrefs: 0137B48F
*** enter .cxr %p for the context, xrefs: 0137B50D
This failed because of error %Ix., xrefs: 0137B446
The resource is owned shared by %d threads, xrefs: 0137B37E
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0137B38F
The instruction at %p referenced memory at %p., xrefs: 0137B432
The critical section is owned by thread %p., xrefs: 0137B3B9
<unknown>, xrefs: 0137B27E, 0137B2D1, 0137B350, 0137B399, 0137B417, 0137B48E
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0137B39B
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0137B305
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0137B53F
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0137B47D
an invalid address, %p, xrefs: 0137B4CF
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0137B484
*** then kb to get the faulting stack, xrefs: 0137B51C

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 25e775b97c1be21e2d5c8e67af58cd3790de7cf250ac19dd0b49a7bf20b1a029
Instruction ID: 2a638ba4d6c96480741bb1ae0ce68c547315659cb19bfc5a0ac9e80a84521f5b
Opcode Fuzzy Hash: 25e775b97c1be21e2d5c8e67af58cd3790de7cf250ac19dd0b49a7bf20b1a029
Instruction Fuzzy Hash: 5F810235A50204FFEB356A4A8C85EEB7F3AEF56B9DF410048F9052B116D369A441CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 01381C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E01381C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x12a48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012CB150();
				} else {
					E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x13b589c);
				E012CB150("Heap error detected at %p (heap handle %p)\n",  *0x13b58a0);
				_t27 =  *0x13b5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01381E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012CB150();
				} else {
					E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E012CB150("Error code: %d - %s\n",  *0x13b5898);
				_t113 =  *0x13b58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012CB150();
					} else {
						E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012CB150("Parameter1: %p\n",  *0x13b58a4);
				}
				_t115 =  *0x13b58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012CB150();
					} else {
						E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012CB150("Parameter2: %p\n",  *0x13b58a8);
				}
				_t117 =  *0x13b58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012CB150();
					} else {
						E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012CB150("Parameter3: %p\n",  *0x13b58ac);
				}
				_t119 =  *0x13b58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012CB150();
					} else {
						E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x13b58b4);
					E012CB150("Last known valid blocks: before - %p, after - %p\n",  *0x13b58b0);
				} else {
					_t120 =  *0x13b58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012CB150();
				} else {
					E012CB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E012CB150("Stack trace available at %p\n", 0x13b58c0);
			}

0x01381c10
0x01381c16
0x01381c1e
0x01381c3d
0x01381c3e
0x01381c20
0x01381c35
0x01381c3a
0x01381c44
0x01381c55
0x01381c5a
0x01381c65
0x01381c67
0x00000000
0x01381c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01381c67
0x01381cdc
0x01381ce5
0x01381d04
0x01381d05
0x01381ce7
0x01381cfc
0x01381d01
0x01381d0b
0x01381d17
0x01381d1f
0x01381d25
0x01381d30
0x01381d4f
0x01381d50
0x01381d32
0x01381d47
0x01381d4c
0x01381d61
0x01381d67
0x01381d68
0x01381d6e
0x01381d79
0x01381d98
0x01381d99
0x01381d7b
0x01381d90
0x01381d95
0x01381daa
0x01381db0
0x01381db1
0x01381db7
0x01381dc2
0x01381de1
0x01381de2
0x01381dc4
0x01381dd9
0x01381dde
0x01381df3
0x01381df9
0x01381dfa
0x01381e00
0x01381e0a
0x01381e13
0x01381e32
0x01381e33
0x01381e15
0x01381e2a
0x01381e2f
0x01381e39
0x01381e4a
0x01381e02
0x01381e02
0x01381e08
0x00000000
0x00000000
0x01381e08
0x01381e5b
0x01381e7a
0x01381e7b
0x01381e5d
0x01381e72
0x01381e77
0x01381e95

Strings

heap_failure_buffer_underrun, xrefs: 01381C9F
heap_failure_cross_heap_operation, xrefs: 01381CC2
heap_failure_multiple_entries_corruption, xrefs: 01381C8A
Error code: %d - %s, xrefs: 01381D12
Parameter1: %p, xrefs: 01381D5C
Stack trace available at %p, xrefs: 01381E86
Parameter3: %p, xrefs: 01381DEE
HEAP: , xrefs: 01381C16, 01381C3D, 01381D04, 01381D4F, 01381D98, 01381DE1, 01381E32, 01381E7A
Last known valid blocks: before - %p, after - %p, xrefs: 01381E45
heap_failure_virtual_block_corruption, xrefs: 01381C91
heap_failure_invalid_allocation_type, xrefs: 01381CB4
heap_failure_listentry_corruption, xrefs: 01381CD0
heap_failure_unknown, xrefs: 01381C75
heap_failure_block_not_busy, xrefs: 01381CA6
Heap error detected at %p (heap handle %p), xrefs: 01381C50
heap_failure_internal, xrefs: 01381C6E
heap_failure_generic, xrefs: 01381C7C
heap_failure_entry_corruption, xrefs: 01381C83
heap_failure_usage_after_free, xrefs: 01381CBB
heap_failure_lfh_bitmap_mismatch, xrefs: 01381CD7
heap_failure_buffer_overrun, xrefs: 01381C98
heap_failure_invalid_argument, xrefs: 01381CAD
heap_failure_freelists_corruption, xrefs: 01381CC9
HEAP[%wZ]: , xrefs: 01381C30, 01381CF7, 01381D42, 01381D8B, 01381DD4, 01381E25, 01381E6D
Parameter2: %p, xrefs: 01381DA5

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: d8ee49fcc84b3ef58e1b133aa13f1779603173d00a5ebef451cae248867c7b5e
Instruction ID: 5b02b6fee8124c9dec4e034e6b1c95ae600a4bfb2a28bb758030eae57f646c79
Opcode Fuzzy Hash: d8ee49fcc84b3ef58e1b133aa13f1779603173d00a5ebef451cae248867c7b5e
Instruction Fuzzy Hash: C861E733631249DFD611BB49D4C5E7477BCEB04FB4B0A806EF60E9B701D6649C468B0A

Uniqueness

Uniqueness Score: -1.00%

Function 012D3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E012D3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E012D1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E012D1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E012D1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E012D1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E012D1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L012E4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0130F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E01311370(_t276, 0x12a4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0130BB40(0,  &_v68, _t170);
									if(L012D43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0130BB40(_t257,  &_v68, _t243);
								if(L012D43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E01311370(_t278, 0x12a4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L012E4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0130F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E01311370(_v16, 0x12a4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0130BB40(_t262,  &_v68, _t244);
								if(L012D43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E01311370(_t282, 0x12a4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0130BB40(_t262,  &_v68, _t201);
							if(L012D43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L012E4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0130F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E01311370(_t280, 0x12a4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0130BB40(_t267,  &_v68, _t245);
							if(L012D43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E01311370(_t284, 0x12a4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0130BB40(_t267,  &_v68, _t224);
						if(L012D43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x012d3d3c
0x012d3d42
0x012d3d44
0x012d3d46
0x012d3d49
0x012d3d4c
0x012d3d4f
0x012d3d52
0x012d3d55
0x012d3d58
0x012d3d5b
0x012d3d5f
0x012d3d61
0x012d3d66
0x01328213
0x01328218
0x012d4085
0x012d4088
0x012d408e
0x012d4094
0x012d409a
0x012d40a0
0x012d40a6
0x012d40a9
0x012d40af
0x012d40b6
0x012d40bd
0x012d40bd
0x012d3d83
0x0132821f
0x01328229
0x01328238
0x01328238
0x0132823d
0x0132823d
0x012d3da0
0x012d3daf
0x012d3db5
0x012d3dba
0x012d3dba
0x012d3dd4
0x012d3e94
0x012d3eab
0x012d3f6d
0x012d3f84
0x012d406b
0x012d406b
0x012d406e
0x012d406e
0x012d4070
0x012d4074
0x01328351
0x01328351
0x012d407a
0x012d407f
0x0132835d
0x01328370
0x01328377
0x01328379
0x0132837c
0x0132837c
0x0132835d
0x00000000
0x012d407f
0x012d3f8a
0x012d3f8d
0x012d3f90
0x012d3f95
0x0132830d
0x0132830f
0x012d3f9b
0x012d3fac
0x012d3fae
0x012d3fb1
0x012d3fb1
0x012d3fb6
0x01328317
0x0132831a
0x00000000
0x012d3fbc
0x012d3fc1
0x012d3fc9
0x012d3fd7
0x012d3fda
0x012d3fdd
0x012d4021
0x012d4021
0x012d4029
0x012d4030
0x012d4044
0x012d4046
0x012d4046
0x012d4044
0x012d4049
0x01328327
0x01328334
0x01328339
0x0132833c
0x012d404f
0x012d404f
0x012d404f
0x012d4051
0x012d4056
0x012d4063
0x012d4063
0x012d4068
0x00000000
0x012d4068
0x012d3fdf
0x012d3fe2
0x012d3fe4
0x012d3fe7
0x012d3fef
0x012d4003
0x012d4005
0x012d4005
0x012d400c
0x012d4013
0x012d4016
0x012d4017
0x012d401b
0x012d401e
0x00000000
0x012d401e
0x012d3fb6
0x012d3eb1
0x012d3eb4
0x012d3eb7
0x012d3ebc
0x013282a9
0x013282ab
0x012d3ec2
0x012d3ed3
0x012d3ed5
0x012d3ed8
0x012d3ed8
0x012d3edd
0x013282b3
0x013282b6
0x00000000
0x012d3ee3
0x012d3ee8
0x012d3eed
0x012d3ef0
0x012d3ef3
0x012d3f02
0x012d3f05
0x012d3f08
0x013282c0
0x013282c3
0x013282c5
0x013282c8
0x013282d0
0x013282e4
0x013282e6
0x013282e6
0x013282ed
0x013282f4
0x013282f7
0x013282f8
0x013282fc
0x013282ff
0x013282ff
0x012d3f0e
0x012d3f11
0x012d3f16
0x012d3f1d
0x012d3f31
0x01328307
0x01328307
0x012d3f31
0x012d3f39
0x012d3f48
0x012d3f4d
0x012d3f50
0x012d3f50
0x012d3f53
0x012d3f58
0x012d3f65
0x012d3f65
0x012d3f6a
0x00000000
0x012d3f6a
0x012d3edd
0x012d3dda
0x012d3ddd
0x012d3de0
0x012d3de5
0x01328245
0x012d3deb
0x012d3df7
0x012d3dfc
0x012d3dfe
0x012d3e01
0x012d3e01
0x012d3e06
0x0132824d
0x0132824f
0x01328254
0x00000000
0x012d3e0c
0x012d3e11
0x012d3e16
0x012d3e19
0x012d3e29
0x012d3e2c
0x012d3e2f
0x0132825c
0x0132825f
0x01328261
0x01328264
0x0132826c
0x01328280
0x01328282
0x01328282
0x01328289
0x01328290
0x01328293
0x01328294
0x01328298
0x0132829b
0x0132829b
0x012d3e35
0x012d3e38
0x012d3e3d
0x012d3e44
0x012d3e58
0x013282a3
0x013282a3
0x012d3e58
0x012d3e60
0x012d3e6f
0x012d3e74
0x012d3e77
0x012d3e77
0x012d3e7a
0x012d3e7f
0x012d3e8c
0x012d3e8c
0x012d3e91
0x00000000
0x012d3e91

Strings

WindowsExcludedProcs, xrefs: 012D3D6F
Kernel-MUI-Language-SKU, xrefs: 012D3F70
Kernel-MUI-Language-Allowed, xrefs: 012D3DC0
Kernel-MUI-Number-Allowed, xrefs: 012D3D8C
Kernel-MUI-Language-Disallowed, xrefs: 012D3E97

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 17462d492c09d0aa2a2885f33dc685cf547cc290475e9329052a5986e636afcb
Instruction ID: d707a259e16189f81723f3f130e1e135243da738a75081713d4c646b812c06f7
Opcode Fuzzy Hash: 17462d492c09d0aa2a2885f33dc685cf547cc290475e9329052a5986e636afcb
Instruction Fuzzy Hash: 03F15F76D20659EFCB15EF98C980AEEBBF9FF08650F14006AE605E7650D7749E01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012F8E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E012F8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x13bd360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x13b8464; // 0x74b10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x13b5780 & 0x00000003) != 0) {
							E01345510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x13b5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0130B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x13b7984; // 0xd92ba0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x13b8464; // 0x74b10110
					 *0x13bb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E012F9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x13b5780 & 0x00000005) != 0) {
						_push(_t49);
						E01345510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x012f8e0f
0x012f8e16
0x012f8e19
0x012f8e1b
0x012f8e21
0x012f8e7f
0x012f8e85
0x01339354
0x0133936c
0x01339371
0x0133937b
0x01339381
0x01339381
0x0133937b
0x012f8e9d
0x012f8e9d
0x012f8e29
0x012f8e2c
0x012f8e38
0x012f8e3e
0x012f8e43
0x012f8eb5
0x012f8eb9
0x013392aa
0x013392af
0x013392e8
0x013392e8
0x013392af
0x012f8eb9
0x012f8e45
0x012f8e53
0x012f8e5b
0x012f8e5f
0x012f8e78
0x012f8e78
0x012f8e7d
0x012f8ec3
0x012f8ecd
0x012f8ed2
0x012f8ed2
0x012f8ec5
0x012f8ec5
0x00000000
0x012f8e7d
0x012f8e67
0x012f8ea4
0x0133931a
0x00000000
0x00000000
0x01339320
0x012f8ea4
0x012f8e70
0x01339325
0x01339340
0x01339345
0x01339345
0x012f8e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0133932A
LdrpFindDllActivationContext, xrefs: 01339331, 0133935D
Querying the active activation context failed with status 0x%08lx, xrefs: 01339357
minkernel\ntdll\ldrsnap.c, xrefs: 0133933B, 01339367

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 871d9ecb6a0fc3fca05494aa61fdb818e96ad5107b07b057004cd9500e823bb2
Instruction ID: 50700f20438361e120f651ecf0230d623be258a1edf9c68af96a679a706af892
Opcode Fuzzy Hash: 871d9ecb6a0fc3fca05494aa61fdb818e96ad5107b07b057004cd9500e823bb2
Instruction Fuzzy Hash: 53410932A30316DFEB36AE1C8C89B79F7A8AB44358F06417DFB5457152E7B05C808781

Uniqueness

Uniqueness Score: -1.00%

Function 012D8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E012D8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E012D934A() != 0) {
								_t159 = E0134A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x13b5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E01345510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x13b5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E012D849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E012D8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E012D8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x13b5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x13b5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E012E2280(_t92, 0x13b86cc);
															_t94 = E01399DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E012F61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x13b5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E012D8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x13b5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x13b5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0130F380(_t136, 0x12a1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E012E2280(_t108, 0x13b86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E012F61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E01399D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E012DFFB0(_t118, _t156, 0x13b86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E01309A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x012d8799
0x012d879d
0x012d87a1
0x012d87a3
0x012d87a8
0x012d87c3
0x012d87c3
0x012d87c8
0x012d87d1
0x012d87d4
0x012d87d8
0x012d87e5
0x012d87ec
0x01329bfe
0x01329c00
0x01329c02
0x01329c08
0x01329c0d
0x01329c0f
0x01329c14
0x01329c2d
0x01329c32
0x01329c37
0x01329c3a
0x01329c3c
0x01329c42
0x01329c42
0x01329c3c
0x01329c02
0x012d87da
0x012d87df
0x012d87e3
0x00000000
0x00000000
0x012d87e3
0x012d87f2
0x00000000
0x012d87fb
0x012d87fd
0x012d87fe
0x012d880e
0x012d880f
0x012d8810
0x012d8814
0x012d881a
0x012d881c
0x012d881f
0x012d8821
0x012d8822
0x012d8824
0x012d8826
0x012d882c
0x012d882e
0x01329c48
0x01329c48
0x012d8834
0x012d8834
0x012d8837
0x00000000
0x00000000
0x012d8837
0x012d882e
0x012d883d
0x012d8840
0x012d8843
0x012d8846
0x012d8849
0x012d884c
0x012d884e
0x012d8850
0x012d8852
0x012d8854
0x012d8857
0x012d88b4
0x012d88b6
0x012d88b6
0x012d8859
0x012d8859
0x012d8859
0x012d8861
0x012d8866
0x012d886a
0x012d893d
0x012d8941
0x00000000
0x012d8947
0x012d8947
0x012d894a
0x012d894c
0x00000000
0x012d8952
0x012d8955
0x012d895a
0x012d895d
0x012d895d
0x012d895f
0x012d8961
0x012d8961
0x012d8968
0x00000000
0x00000000
0x012d896a
0x012d896b
0x012d896e
0x00000000
0x012d8970
0x012d8970
0x012d8970
0x012d8970
0x012d8972
0x012d8972
0x012d8974
0x00000000
0x012d897a
0x012d897a
0x012d897d
0x00000000
0x012d8983
0x01329c65
0x01329c6d
0x01329c72
0x01329c75
0x01329c75
0x01329c82
0x01329c86
0x01329c87
0x01329c88
0x01329c89
0x01329c8c
0x01329c90
0x01329c95
0x01329c97
0x01329ca0
0x01329ca3
0x01329ca9
0x01329ca9
0x00000000
0x01329ca9
0x01329ca3
0x00000000
0x01329c97
0x012d897d
0x00000000
0x012d8974
0x012d8988
0x012d8992
0x012d8996
0x00000000
0x012d8996
0x012d894c
0x00000000
0x012d8870
0x012d887b
0x012d887d
0x012d887f
0x012d8881
0x012d8884
0x012d8884
0x012d8886
0x012d8889
0x012d888c
0x012d888e
0x012d8891
0x012d8891
0x012d8898
0x00000000
0x00000000
0x012d889a
0x012d889b
0x012d889e
0x00000000
0x00000000
0x012d88a0
0x012d88a8
0x012d88b0
0x012d88b2
0x012d88d3
0x012d88d5
0x00000000
0x012d88d7
0x012d88db
0x012d88dc
0x012d88e0
0x012d88e8
0x012d88ee
0x012d88f0
0x012d88f3
0x012d88fc
0x012d8901
0x012d8906
0x012d890c
0x012d890c
0x012d890f
0x012d8916
0x012d8917
0x012d8918
0x012d8919
0x012d891a
0x012d891f
0x012d8921
0x01329c52
0x01329c55
0x01329c5b
0x01329cac
0x01329cc0
0x01329cc0
0x01329c55
0x012d8927
0x012d8927
0x012d892f
0x012d8933
0x00000000
0x012d88f5
0x012d88f5
0x00000000
0x012d88f7
0x012d88f7
0x012d88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x012d88fa
0x012d88f5
0x012d88f3
0x00000000
0x012d88d5
0x00000000
0x012d88b2
0x012d88c9
0x00000000
0x012d88c9
0x012d887f
0x012d886a
0x012d8857
0x012d8852
0x012d88bf
0x012d88bf
0x012d87aa
0x012d87ad
0x012d87ae
0x012d87b4
0x012d87b5
0x012d87b6
0x012d87b8
0x012d87bd
0x012d87c1
0x012d87f4
0x012d87fa
0x00000000
0x00000000
0x00000000
0x012d87c1
0x00000000

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 01329C18
LdrpDoPostSnapWork, xrefs: 01329C1E
minkernel\ntdll\ldrsnap.c, xrefs: 01329C28

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: f96b0739967429bcbfa69af71623374260cca592893cc50520fcf3eeeccbeb3b
Instruction ID: 37c9a3f2ab0583ea1b08171b814ef915cc916157650ff6834ceba774ddd0a15c
Opcode Fuzzy Hash: f96b0739967429bcbfa69af71623374260cca592893cc50520fcf3eeeccbeb3b
Instruction Fuzzy Hash: 83910471A2022BDFEF18DF59D481ABAB7B9FF44318F454069EA45AB240E730E901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012D7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E012D7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E012DCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E012CC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x13b5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E01345510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x13b5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E012E7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E012E7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E01347016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E012E7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E012E7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E01347016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E012FA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E012CB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x012d7e4c
0x012d7e50
0x012d7e55
0x012d7e58
0x012d7e5d
0x012d7e71
0x012d7f33
0x012d7e77
0x012d7e77
0x012d7e79
0x012d7e79
0x012d7e7e
0x012d7f45
0x01329848
0x00000000
0x01329848
0x012d7f4e
0x012d7f53
0x012d7f5a
0x00000000
0x00000000
0x0132985a
0x01329862
0x01329866
0x00000000
0x0132986c
0x00000000
0x0132986c
0x012d7e84
0x012d7e84
0x012d7e8d
0x01329871
0x012d7eb8
0x012d7ec0
0x012d7ec0
0x012d7e9a
0x0132987e
0x00000000
0x00000000
0x01329884
0x0132988b
0x013298a7
0x013298ac
0x013298b1
0x013298b6
0x013298b8
0x013298b8
0x013298b9
0x00000000
0x013298b9
0x012d7ea0
0x012d7ea7
0x00000000
0x00000000
0x012d7eac
0x012d7eb1
0x012d7ec6
0x012d7ed0
0x013298cc
0x012d7ed6
0x012d7ed6
0x012d7ed6
0x012d7ede
0x012d7ee3
0x013298e3
0x013298f0
0x01329902
0x013298f2
0x013298fb
0x013298fb
0x01329907
0x0132991d
0x0132991d
0x01329907
0x013298e3
0x012d7ef0
0x012d7f14
0x012d7f14
0x012d7f1e
0x01329946
0x012d7f24
0x012d7f24
0x012d7f24
0x012d7f2c
0x0132996a
0x01329975
0x01329975
0x0132997e
0x01329993
0x01329993
0x0132997e
0x00000000
0x012d7ef2
0x012d7efc
0x012d7f0a
0x012d7f0e
0x01329933
0x00000000
0x01329933
0x00000000
0x012d7f0e
0x00000000
0x00000000
0x00000000
0x012d7eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 013298A2
LdrpCompleteMapModule, xrefs: 01329898
Could not validate the crypto signature for DLL %wZ, xrefs: 01329891

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 8a6b7ff7726a82dbbb90c96213546c6af37e7916b55ba3123e83e144a32d66f6
Instruction ID: 6c53e2c5fe37a781ac5bcbeec2d4b0f65b8008fec96fef3bdf16a158bd6c1573
Opcode Fuzzy Hash: 8a6b7ff7726a82dbbb90c96213546c6af37e7916b55ba3123e83e144a32d66f6
Instruction Fuzzy Hash: E6510131A20756DBEB22DB6CC944B6A7BE4EB0031CF0406A9EA519B7D1D7B8ED00C790

Uniqueness

Uniqueness Score: -1.00%

Function 012CE620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E012CE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E012CF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E013095D0();
						}
						if(_t78 != 0) {
							L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0130FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0130BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E01309600();
					if(_t97 < 0) {
						goto L6;
					}
					E0130BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L012CF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0130BB40(_t83, _t102 + 0x24, _t78);
								if(L012D43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0130BB40(_t84, _t102 + 0x24, _t94);
									if(L012D43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x012ce620
0x012ce628
0x012ce62f
0x012ce631
0x012ce635
0x012ce637
0x012ce63e
0x01325503
0x01325503
0x012ce64c
0x012ce64c
0x012ce651
0x00000000
0x00000000
0x012ce661
0x012ce665
0x0132542a
0x012ce715
0x012ce71a
0x012ce71c
0x012ce720
0x012ce720
0x012ce727
0x012ce736
0x012ce736
0x012ce743
0x012ce743
0x012ce673
0x012ce678
0x012ce67d
0x012ce682
0x012ce685
0x012ce692
0x012ce69b
0x012ce6a3
0x012ce6ad
0x012ce6b1
0x012ce6b2
0x012ce6bb
0x012ce6bf
0x012ce6c0
0x012ce6c8
0x012ce6cc
0x012ce6d5
0x012ce6d9
0x00000000
0x00000000
0x012ce6e5
0x012ce6ea
0x012ce6f9
0x012ce70b
0x012ce70f
0x01325439
0x0132545e
0x0132545e
0x00000000
0x0132545e
0x0132543b
0x0132543e
0x01325440
0x01325445
0x01325472
0x01325475
0x0132548d
0x01325493
0x013254a9
0x00000000
0x00000000
0x013254ab
0x013254b4
0x013254bc
0x013254c8
0x013254de
0x013254fb
0x013254e0
0x013254e6
0x013254eb
0x013254eb
0x013254de
0x00000000
0x013254bc
0x01325477
0x0132547a
0x01325480
0x01325483
0x01325486
0x0132548b
0x00000000
0x00000000
0x00000000
0x0132548b
0x00000000
0x00000000
0x00000000
0x00000000
0x01325447
0x01325447
0x01325447
0x01325447
0x0132544e
0x00000000
0x00000000
0x01325450
0x01325452
0x01325455
0x0132545a
0x00000000
0x00000000
0x00000000
0x0132545c
0x0132546a
0x0132546d
0x0132546f
0x00000000
0x0132546f
0x012ce70f

Strings

InstallLanguageFallback, xrefs: 012CE6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 012CE68C
@, xrefs: 012CE6C0

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: bdf51ea5f90f2008ee12c4f33d0807c42c62386dc9ef36bad96574bd4eefbebd
Instruction ID: 6d661fdf2bac1c1bf22de02c3b1b7348bf8a8483d9a9c172e2b78b666691c99f
Opcode Fuzzy Hash: bdf51ea5f90f2008ee12c4f33d0807c42c62386dc9ef36bad96574bd4eefbebd
Instruction Fuzzy Hash: 1951E7765143569BD715EF28C840ABBB7E8BF88618F05092EFA85E7240F734DA04C792

Uniqueness

Uniqueness Score: -1.00%

Function 0138E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0138E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E0138BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E0138BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E0138AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E01309730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E0138A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E0138A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E01309730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E0138A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E0138A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E012E2280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E012DB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E012DFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E012E7D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0137FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x0138e547
0x0138e549
0x0138e54f
0x0138e553
0x0138e557
0x0138e55a
0x0138e55c
0x0138e55f
0x0138e561
0x0138e567
0x0138e56b
0x0138e7e2
0x00000000
0x0138e571
0x0138e575
0x0138e577
0x0138e57b
0x0138e57c
0x0138e57d
0x0138e57e
0x0138e57f
0x0138e588
0x0138e58f
0x0138e591
0x0138e592
0x0138e592
0x0138e596
0x0138e59e
0x0138e5a0
0x0138e5a6
0x0138e61d
0x0138e61d
0x0138e621
0x0138e623
0x0138e630
0x0138e630
0x0138e7e6
0x0138e7eb
0x0138e7ed
0x0138e7f4
0x0138e7fa
0x0138e7ff
0x0138e7ff
0x0138e80a
0x0138e812
0x0138e812
0x0138e5ab
0x0138e5b4
0x0138e5b9
0x0138e5be
0x0138e5c0
0x0138e5c2
0x0138e5c8
0x0138e5c9
0x0138e5cb
0x0138e5cc
0x0138e5d5
0x0138e5e4
0x0138e5f1
0x0138e5f8
0x0138e5f8
0x0138e5d5
0x0138e602
0x0138e616
0x0138e63d
0x0138e644
0x0138e64d
0x0138e652
0x0138e657
0x0138e659
0x0138e65b
0x0138e661
0x0138e662
0x0138e664
0x0138e665
0x0138e66e
0x0138e67d
0x0138e68a
0x0138e691
0x0138e691
0x0138e66e
0x0138e6b0
0x00000000
0x0138e6b6
0x0138e6bd
0x0138e6c7
0x0138e6d7
0x0138e6d9
0x0138e6db
0x0138e6de
0x0138e6e3
0x0138e6f3
0x0138e6fc
0x0138e700
0x0138e700
0x0138e704
0x0138e70a
0x0138e70a
0x0138e713
0x0138e716
0x0138e719
0x0138e720
0x0138e761
0x0138e76b
0x0138e774
0x0138e77a
0x0138e77a
0x0138e78a
0x0138e791
0x0138e799
0x0138e79b
0x0138e79f
0x0138e7aa
0x0138e7c0
0x0138e7ac
0x0138e7b2
0x0138e7b9
0x0138e7b9
0x0138e7c7
0x0138e806
0x00000000
0x0138e7c9
0x0138e7d1
0x0138e7d8
0x00000000
0x0138e7d8
0x00000000
0x00000000
0x0138e722
0x0138e72e
0x0138e748
0x0138e74c
0x0138e754
0x0138e756
0x0138e75c
0x0138e75c
0x00000000
0x0138e75c
0x0138e758
0x0138e758
0x00000000
0x0138e758
0x0138e750
0x00000000
0x00000000
0x0138e752
0x00000000
0x0138e752
0x0138e730
0x0138e735
0x0138e73d
0x0138e73f
0x00000000
0x00000000
0x0138e741
0x0138e741
0x00000000
0x0138e741
0x0138e739
0x00000000
0x00000000
0x0138e73b
0x00000000
0x0138e73b
0x0138e722
0x0138e720
0x0138e6b0
0x0138e618
0x00000000
0x0138e618

Strings

`, xrefs: 0138E670
`, xrefs: 0138E5D7

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: c2c0cf23900a5b78edcb0dfb03a89ff18bcdca1d59502357b8b4e7f390fca087
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 87916E312043429BE725EF29C945B1BBBE5BF84728F14892DF6A5CB290E774E904CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013451BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E013451BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x13a05f0);
				E0131D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E012DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E013453CA(0);
						return E0131D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E0130F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E012E3690(1, _t117, 0x12a1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E0130AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L012E4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E0130AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E0134500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E01309860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x013451be
0x013451c3
0x013451c8
0x013451cd
0x013451d0
0x013451d3
0x013451d8
0x013451db
0x013451de
0x013451e0
0x013451e3
0x013451e6
0x013451e8
0x01345342
0x01345351
0x01345356
0x0134535a
0x01345360
0x01345363
0x01345366
0x01345369
0x01345369
0x0134536b
0x0134536b
0x01345370
0x013453a3
0x013453a4
0x013453a6
0x013453ab
0x013453ab
0x013453ae
0x013453ae
0x013453b5
0x013453bf
0x013453bf
0x01345375
0x01345396
0x013453a0
0x013453a0
0x00000000
0x01345396
0x01345377
0x01345379
0x0134537f
0x0134538c
0x01345390
0x00000000
0x01345390
0x013451ee
0x013451f1
0x01345301
0x01345310
0x01345315
0x01345318
0x0134531b
0x01345320
0x0134532e
0x01345331
0x00000000
0x01345331
0x01345328
0x01345329
0x00000000
0x01345329
0x013451fa
0x01345235
0x01345236
0x01345239
0x0134523f
0x01345240
0x01345241
0x01345242
0x01345246
0x01345247
0x0134524e
0x01345251
0x01345267
0x01345269
0x0134526e
0x0134527d
0x0134527e
0x01345281
0x01345282
0x01345287
0x01345288
0x0134528a
0x0134528f
0x01345294
0x00000000
0x00000000
0x0134529a
0x0134529c
0x0134529e
0x0134529e
0x013452a4
0x013452b0
0x00000000
0x00000000
0x013452ba
0x013452bc
0x013452bc
0x013452d4
0x013452d9
0x013452dc
0x013452e1
0x00000000
0x00000000
0x013452e7
0x013452f4
0x00000000
0x013452f4
0x01345270
0x00000000
0x01345270
0x013451fc
0x013451fd
0x01345202
0x01345203
0x01345205
0x0134520a
0x0134520f
0x00000000
0x00000000
0x0134521b
0x01345226
0x0134522b
0x0134521d
0x0134521d
0x01345222
0x01345222
0x0134522d
0x00000000

Strings

UEFI, xrefs: 0134521D
Legacy, xrefs: 01345226

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: a9b9867d55d8e2ca1a3c31e3ff491f79da35ef70d32e788c02e3b47eafd8f722
Instruction ID: f8bb6fad4bbfacba8d9ea7429b6a35423e2a7c85cc473b466d8d2e75a4631a06
Opcode Fuzzy Hash: a9b9867d55d8e2ca1a3c31e3ff491f79da35ef70d32e788c02e3b47eafd8f722
Instruction Fuzzy Hash: 40515C71E006099FDB25DFA8C850BAEBBF8FF48708F14406EE649EB291D671A940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012CB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E012CB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x139f7a8);
				E0131D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0131D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0130D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0130F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0131DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0130B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0130B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0130E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0130A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x012cb171
0x012cb171
0x012cb171
0x012cb171
0x012cb171
0x012cb176
0x012cb17b
0x012cb180
0x012cb186
0x012cb18f
0x012cb198
0x012cb1a4
0x012cb1aa
0x01324802
0x01324802
0x01324805
0x0132480c
0x0132480e
0x012cb1d1
0x012cb1d3
0x012cb1de
0x012cb1de
0x01324817
0x0132481e
0x01324820
0x01324822
0x01324822
0x01324824
0x01324824
0x0132482a
0x00000000
0x00000000
0x01324835
0x0132483a
0x0132483d
0x0132483f
0x01324842
0x01324842
0x01324842
0x01324846
0x0132484c
0x0132484e
0x01324851
0x01324851
0x01324853
0x01324854
0x01324854
0x01324858
0x0132485a
0x0132485a
0x0132485d
0x0132485f
0x01324861
0x01324861
0x01324866
0x0132486b
0x0132486e
0x01324871
0x01324876
0x01324876
0x01324878
0x0132487b
0x01324884
0x01324884
0x00000000
0x0132487d
0x0132487d
0x01324882
0x01324889
0x01324889
0x0132488f
0x01324891
0x013248e0
0x013248e2
0x013248e4
0x013248e4
0x013248e7
0x013248e7
0x013248ed
0x013248f4
0x013248f6
0x01324951
0x01324951
0x01324953
0x01324953
0x01324956
0x01324956
0x01324958
0x01324959
0x01324959
0x0132495d
0x0132495d
0x0132495f
0x0132495f
0x01324965
0x01324969
0x013249ba
0x013249ba
0x013249c1
0x013249c5
0x013249cc
0x013249d4
0x013249d7
0x013249da
0x013249e4
0x013249e5
0x013249f3
0x01324a02
0x00000000
0x01324a02
0x01324972
0x01324974
0x00000000
0x00000000
0x01324976
0x01324979
0x01324982
0x01324983
0x01324984
0x0132498b
0x0132498d
0x01324991
0x01324993
0x01324999
0x0132499d
0x013249a2
0x013249a2
0x013249a2
0x01324999
0x013249ac
0x00000000
0x013249b3
0x013248f8
0x013248fe
0x00000000
0x00000000
0x00000000
0x013248fe
0x01324895
0x0132489c
0x013248ad
0x013248b2
0x013248b5
0x013248b7
0x013248ba
0x013248bc
0x013248c6
0x013248c6
0x013248cb
0x013248d1
0x013248d4
0x013248d8
0x013248d8
0x00000000
0x013248d8
0x013248be
0x013248c0
0x00000000
0x00000000
0x013248c2
0x00000000
0x00000000
0x00000000
0x013248c4
0x00000000
0x01324882
0x0132487b
0x01324904
0x01324906
0x00000000
0x00000000
0x01324908
0x0132490e
0x00000000
0x00000000
0x01324910
0x01324917
0x01324917
0x00000000
0x01324917
0x012cb1ba
0x013247f9
0x013247fc
0x00000000
0x00000000
0x00000000
0x013247fc
0x012cb1c0
0x012cb1c0
0x012cb1c3
0x012cb1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 013248AD

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 1104533c29dff7a59aa7742328d8eaac57ab002309f6a99db110a7020049fddb
Instruction ID: d9aa9a896df3bc0f9f84475bc009d63403072c9a076f19b440f6e4cba6ec5147
Opcode Fuzzy Hash: 1104533c29dff7a59aa7742328d8eaac57ab002309f6a99db110a7020049fddb
Instruction Fuzzy Hash: 7B51F371E102698EDB36EF68C845BBEBFF0AF01718F1041ADD959AB282D7B14941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012EB944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E012EB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x13bd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E012E7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E01398CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E01309E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0130B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0130CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E012E7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E01398F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0130AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x13b8628; // 0x0
								_v68 = _t77;
								_t78 =  *0x13b862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x13b8628; // 0x0
							_t116 =  *0x13b862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x012eb94c
0x012eb956
0x012eb95c
0x012eb95e
0x012eb964
0x012eb969
0x012eb96d
0x012eb96d
0x012eb970
0x012eb974
0x012eb97a
0x012ebadf
0x012ebadf
0x012ebae2
0x012ebae4
0x012ebae6
0x012ebaf0
0x01332cb8
0x012ebaf6
0x012ebaf6
0x012ebaf6
0x012ebafd
0x012ebb1f
0x012ebb1f
0x012ebaff
0x012ebb00
0x012ebb00
0x012ebb03
0x012ebb03
0x012ebacb
0x012ebacf
0x012ebad0
0x012ebad1
0x012ebadc
0x012ebadc
0x012eb980
0x012eb980
0x012eb988
0x012eb98b
0x012eb98d
0x012eb990
0x012eb993
0x012eb999
0x012eb99b
0x012eb9a1
0x012eb9a5
0x012eb9aa
0x012eb9b0
0x012eb9bb
0x012eb9c0
0x012eb9c3
0x012eb9ca
0x012eb9cc
0x012eb9cf
0x012eb9d3
0x012eb9d7
0x012eba94
0x012eba94
0x012eba98
0x012ebaa3
0x01332ccb
0x012ebaa9
0x012ebaa9
0x012ebaa9
0x012ebab1
0x01332cd5
0x01332cdd
0x01332cdd
0x012ebabb
0x012ebabc
0x012ebac2
0x012ebac3
0x012ebac3
0x012ebac6
0x00000000
0x012eb9dd
0x012eb9dd
0x012eb9e7
0x012eb9e7
0x012eb9ec
0x012eb9ec
0x012eb9f1
0x012eb9f5
0x012eb9fa
0x012eba00
0x012eba0c
0x012eba10
0x012eba10
0x012eba12
0x012eba18
0x00000000
0x00000000
0x012ebb26
0x012ebb26
0x012eba1e
0x012eba1e
0x012eba23
0x012eba25
0x012eba2c
0x012eba30
0x012eba35
0x012eba35
0x012eba41
0x012eba46
0x012eba4c
0x012eba50
0x012eba54
0x012eba6a
0x012eba6e
0x012eba70
0x012eba74
0x012eba78
0x012eba7a
0x012eba7c
0x012eba8e
0x012eba90
0x012eba92
0x012ebb14
0x012ebb14
0x012ebb16
0x012ebb16
0x00000000
0x012eba7c
0x012ebb0a
0x012ebb0d
0x00000000
0x00000000
0x00000000
0x012ebb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012EB9A5

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 3e10875ffae5b50b9ac962f9e799d1dc72e304fdc0de074272fa0ee5e8137412
Instruction ID: f68a8321058d559eb4c4005466a505af6c95468f5e3cf4c833db6b574fd7193c
Opcode Fuzzy Hash: 3e10875ffae5b50b9ac962f9e799d1dc72e304fdc0de074272fa0ee5e8137412
Instruction Fuzzy Hash: 31516A71A28341CFCB21CF2DC0C492ABBE9FB88614F54496EEA8587355E770E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 012F2581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E012F2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, intOrPtr _a35) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t240;
				signed int _t244;
				signed int _t245;
				signed int _t254;
				signed int _t256;
				intOrPtr _t258;
				signed int _t261;
				signed int _t268;
				signed int _t271;
				signed int _t279;
				intOrPtr _t285;
				signed int _t287;
				signed int _t289;
				void* _t290;
				signed int _t291;
				signed int _t292;
				unsigned int _t295;
				signed int _t299;
				signed int* _t300;
				signed int _t301;
				signed int _t305;
				intOrPtr _t317;
				signed int _t326;
				signed int _t328;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t338;
				signed int _t340;
				void* _t341;
				signed int _t343;
				void* _t344;

				_t338 = _t340;
				_t341 = _t340 - 0x4c;
				_v8 =  *0x13bd360 ^ _t338;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t333 = 0x13bb2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t295 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t344 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t285 = 0x48;
				_t315 = 0 | _t344 == 0x00000000;
				_t326 = 0;
				_v37 = _t344 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t285 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t334 = 0xc0000106;
						goto L32;
					} else {
						_t333 = L012E4620(_t295,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t285);
						_v52 = _t333;
						__eflags = _t333;
						if(_t333 == 0) {
							_t334 = 0xc0000017;
							goto L32;
						} else {
							 *(_t333 + 0x44) =  *(_t333 + 0x44) & 0x00000000;
							_t50 = _t333 + 0x48; // 0x48
							_t328 = _t50;
							_t315 = _v32;
							 *((intOrPtr*)(_t333 + 0x3c)) = _t285;
							_t287 = 0;
							 *((short*)(_t333 + 0x30)) = _v48;
							__eflags = _t315;
							if(_t315 != 0) {
								 *(_t333 + 0x18) = _t328;
								__eflags = _t315 - 0x13b8478;
								 *_t333 = ((0 | _t315 == 0x013b8478) - 0x00000001 & 0xfffffffb) + 7;
								E0130F3E0(_t328,  *((intOrPtr*)(_t315 + 4)),  *_t315 & 0x0000ffff);
								_t315 = _v32;
								_t341 = _t341 + 0xc;
								_t287 = 1;
								__eflags = _a8;
								_t328 = _t328 + (( *_t315 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t279 = E013539F2(_t328);
									_t315 = _v32;
									_t328 = _t279;
								}
							}
							_t299 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t334 = _v68;
								__eflags = 0;
								 *((short*)(_t328 - 2)) = 0;
								goto L32;
							} else {
								_t289 = _t333 + _t287 * 4;
								_v56 = _t289;
								do {
									__eflags = _t315;
									if(_t315 != 0) {
										_t240 =  *(_v60 + _t299 * 4);
										__eflags = _t240;
										if(_t240 == 0) {
											goto L30;
										} else {
											__eflags = _t240 == 5;
											if(_t240 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t289 =  *(_v60 + _t299 * 4);
										 *(_t289 + 0x18) = _t328;
										_t244 =  *(_v60 + _t299 * 4);
										__eflags = _t244 - 8;
										if(_t244 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t244 * 4 +  &M012F2959))) {
												case 0:
													__ax =  *0x13b8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E0130F3E0(__edi,  *0x13b848c, __ax & 0x0000ffff);
														__eax =  *0x13b8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E0130F3E0(_t328, _v80, _v64);
													_t274 = _v64;
													goto L26;
												case 2:
													 *0x13b8480 & 0x0000ffff = E0130F3E0(__edi,  *0x13b8484,  *0x13b8480 & 0x0000ffff);
													__eax =  *0x13b8480 & 0x0000ffff;
													__eax = ( *0x13b8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E0130F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E0130F3E0(_t328, _v76, _v36);
														_t274 = _v36;
													}
													L26:
													_t341 = _t341 + 0xc;
													_t328 = _t328 + (_t274 >> 1) * 2 + 2;
													__eflags = _t328;
													L27:
													_push(0x3b);
													_pop(_t276);
													 *((short*)(_t328 - 2)) = _t276;
													goto L28;
												case 6:
													__ebx =  *0x13b575c;
													__eflags = __ebx - 0x13b575c;
													if(__ebx != 0x13b575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E0130F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x13b575c;
														} while (__ebx != 0x13b575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x13b8478 & 0x0000ffff = E0130F3E0(__edi,  *0x13b847c,  *0x13b8478 & 0x0000ffff);
													__eax =  *0x13b8478 & 0x0000ffff;
													__eax = ( *0x13b8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E013539F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x13b6e58 & 0x0000ffff = E0130F3E0(__edi,  *0x13b6e5c,  *0x13b6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x13b6e58 & 0x0000ffff;
													__eax = ( *0x13b6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t299 = _v16;
													_t315 = _v32;
													L29:
													_t289 = _t289 + 4;
													__eflags = _t289;
													_v56 = _t289;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t299 = _t299 + 1;
									_v16 = _t299;
									__eflags = _t299 - _v48;
								} while (_t299 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t244 =  *(_v60 + _t326 * 4);
						if(_t244 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t244 * 4 +  &M012F2935))) {
							case 0:
								__ax =  *0x13b8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t315 =  &_v64;
								_v80 = E012F2E3E(0,  &_v64);
								_t285 = _t285 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x13b8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x13b8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E012DEEF0(0x13b79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E012DEB70(__ecx, 0x13b79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t218 = _v72;
											__eflags = _t218;
											if(_t218 != 0) {
												L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t218);
											}
											_t219 = _v52;
											__eflags = _t219;
											if(_t219 != 0) {
												__eflags = _t334;
												if(_t334 < 0) {
													L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t219);
													_t219 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t295 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x13b7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L012E4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E012DEB70(__ecx, 0x13b79a0);
										__eax = _v52;
										L36:
										_pop(_t327);
										_pop(_t335);
										__eflags = _v8 ^ _t338;
										_pop(_t286);
										return E0130B640(_t219, _t286, _v8 ^ _t338, _t315, _t327, _t335);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t281 = _v56;
								if(_v56 != 0) {
									_t315 =  &_v36;
									_t283 = E012F2E3E(_t281,  &_v36);
									_t295 = _v36;
									_v76 = _t283;
								}
								if(_t295 == 0) {
									goto L44;
								} else {
									_t285 = _t285 + 2 + _t295;
								}
								goto L14;
							case 6:
								__eax =  *0x13b5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x13b8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x13b8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x13b6e58 & 0x0000ffff;
								__eax = ( *0x13b6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t326 = _t326 + 1;
								if(_t326 >= _v48) {
									goto L16;
								} else {
									_t315 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t300 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("das");
					 *((intOrPtr*)(_t333 + 0x28)) =  *((intOrPtr*)(_t333 + 0x28)) + _t341;
					asm("das");
					_t245 = _t244 + _t341;
					asm("daa");
					asm("das");
					 *_t333 =  *_t333 + _t338;
					asm("das");
					 *((intOrPtr*)(_t333 + 0x28)) =  *((intOrPtr*)(_t333 + 0x28)) + _t245;
					asm("das");
					 *0x1f012f26 =  *0x1f012f26 + _t245;
					_pop(_t290);
					_t247 = _t341;
					_t343 = _t245 ^  *_t300;
					 *_t328 =  *_t328 - _t300;
					 *0x201335b =  *0x201335b + _t333;
					 *_t328 =  *_t328 - _t338;
					 *((intOrPtr*)(_t247 - 0x9fed0d8)) =  *((intOrPtr*)(_t341 - 0x9fed0d8)) + _t341;
					asm("daa");
					asm("das");
					 *_t333 =  *_t333 + _t290;
					 *_t328 =  *_t328 - _t300;
					 *((intOrPtr*)(_t333 + 0x28)) =  *((intOrPtr*)(_t333 + 0x28)) + _t300;
					asm("das");
					_a35 = _a35 + _t290;
					asm("das");
					_pop(_t291);
					asm("das");
					 *((intOrPtr*)(_t343 + _t291 * 2)) =  *((intOrPtr*)(_t343 + _t291 * 2)) + _t333;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x139ff00);
					E0131D08C(_t291, _t328, _t333);
					_v44 =  *[fs:0x18];
					_t329 = 0;
					 *_a24 = 0;
					_t292 = _a12;
					__eflags = _t292;
					if(_t292 == 0) {
						_t254 = 0xc0000100;
					} else {
						_v8 = 0;
						_t336 = 0xc0000100;
						_v52 = 0xc0000100;
						_t256 = 4;
						while(1) {
							_v40 = _t256;
							__eflags = _t256;
							if(_t256 == 0) {
								break;
							}
							_t305 = _t256 * 0xc;
							_v48 = _t305;
							__eflags = _t292 -  *((intOrPtr*)(_t305 + 0x12a1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t271 = E0130E5C0(_a8,  *((intOrPtr*)(_t305 + 0x12a1668)), _t292);
									_t343 = _t343 + 0xc;
									__eflags = _t271;
									if(__eflags == 0) {
										_t336 = E013451BE(_t292,  *((intOrPtr*)(_v48 + 0x12a166c)), _a16, _t329, _t336, __eflags, _a20, _a24);
										_v52 = _t336;
										break;
									} else {
										_t256 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t256 = _t256 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t336;
						__eflags = _t336;
						if(_t336 < 0) {
							__eflags = _t336 - 0xc0000100;
							if(_t336 == 0xc0000100) {
								_t301 = _a4;
								__eflags = _t301;
								if(_t301 != 0) {
									_v36 = _t301;
									__eflags =  *_t301 - _t329;
									if( *_t301 == _t329) {
										_t336 = 0xc0000100;
										goto L76;
									} else {
										_t317 =  *((intOrPtr*)(_v44 + 0x30));
										_t258 =  *((intOrPtr*)(_t317 + 0x10));
										__eflags =  *((intOrPtr*)(_t258 + 0x48)) - _t301;
										if( *((intOrPtr*)(_t258 + 0x48)) == _t301) {
											__eflags =  *(_t317 + 0x1c);
											if( *(_t317 + 0x1c) == 0) {
												L106:
												_t336 = E012F2AE4( &_v36, _a8, _t292, _a16, _a20, _a24);
												_v32 = _t336;
												__eflags = _t336 - 0xc0000100;
												if(_t336 != 0xc0000100) {
													goto L69;
												} else {
													_t329 = 1;
													_t301 = _v36;
													goto L75;
												}
											} else {
												_t261 = E012D6600( *(_t317 + 0x1c));
												__eflags = _t261;
												if(_t261 != 0) {
													goto L106;
												} else {
													_t301 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t336 = E012F2C50(_t301, _a8, _t292, _a16, _a20, _a24, _t329);
											L76:
											_v32 = _t336;
											goto L69;
										}
									}
									goto L108;
								} else {
									E012DEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t336 = _a24;
									_t268 = E012F2AE4( &_v36, _a8, _t292, _a16, _a20, _t336);
									_v32 = _t268;
									__eflags = _t268 - 0xc0000100;
									if(_t268 == 0xc0000100) {
										_v32 = E012F2C50(_v36, _a8, _t292, _a16, _a20, _t336, 1);
									}
									_v8 = _t329;
									E012F2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t254 = _t336;
					}
					L70:
					return E0131D0D1(_t254);
				}
				L108:
			}

0x012f2584
0x012f2586
0x012f2590
0x012f2596
0x012f2597
0x012f2598
0x012f2599
0x012f259e
0x012f25a4
0x012f25a9
0x012f25ac
0x012f25ae
0x012f25b1
0x012f25b2
0x012f25b5
0x012f25b8
0x012f25bb
0x012f25bc
0x012f25bf
0x012f25c2
0x012f25c5
0x012f25c6
0x012f25cb
0x012f25ce
0x012f25d8
0x012f25db
0x012f25dd
0x012f25de
0x012f25e1
0x012f25e3
0x012f25e9
0x012f26da
0x012f26da
0x012f26dd
0x012f26e2
0x01335b56
0x00000000
0x012f26e8
0x012f26f9
0x012f26fb
0x012f26fe
0x012f2700
0x01335b60
0x00000000
0x012f2706
0x012f2706
0x012f270a
0x012f270a
0x012f270d
0x012f2713
0x012f2716
0x012f2718
0x012f271c
0x012f271e
0x01335b6c
0x01335b6f
0x01335b7f
0x01335b89
0x01335b8e
0x01335b93
0x01335b96
0x01335b9c
0x01335ba0
0x01335ba3
0x01335bab
0x01335bb0
0x01335bb3
0x01335bb3
0x01335ba3
0x012f2724
0x012f2726
0x012f2729
0x012f272c
0x012f279d
0x012f279d
0x012f27a0
0x012f27a2
0x00000000
0x012f272e
0x012f272e
0x012f2731
0x012f2734
0x012f2734
0x012f2736
0x01335bc1
0x01335bc1
0x01335bc4
0x00000000
0x01335bca
0x01335bca
0x01335bcd
0x00000000
0x01335bd3
0x00000000
0x01335bd3
0x01335bcd
0x012f273c
0x012f273c
0x012f2742
0x012f2747
0x012f274a
0x012f274d
0x012f2750
0x00000000
0x012f2756
0x012f2756
0x00000000
0x012f2902
0x012f2908
0x012f290b
0x00000000
0x012f2911
0x012f291c
0x012f2921
0x00000000
0x012f2921
0x00000000
0x00000000
0x012f2880
0x012f2887
0x012f288c
0x00000000
0x00000000
0x012f2805
0x012f280a
0x012f2814
0x012f2816
0x00000000
0x00000000
0x012f281e
0x012f2821
0x012f2823
0x00000000
0x012f2829
0x012f2829
0x012f2831
0x012f283c
0x012f283e
0x00000000
0x012f283e
0x00000000
0x00000000
0x012f284e
0x012f2850
0x012f2851
0x012f2854
0x012f2857
0x012f285a
0x012f285c
0x012f285d
0x00000000
0x00000000
0x012f275d
0x012f2761
0x00000000
0x012f2767
0x012f276e
0x012f2773
0x012f2773
0x012f2776
0x012f2778
0x012f277e
0x012f277e
0x012f2781
0x012f2781
0x012f2783
0x012f2784
0x00000000
0x00000000
0x01335bd8
0x01335bde
0x01335be4
0x01335be6
0x01335be8
0x01335be9
0x01335bee
0x01335bf8
0x01335bff
0x01335c01
0x01335c04
0x01335c07
0x01335c0b
0x01335c0d
0x01335c0d
0x01335c15
0x01335c18
0x01335c1b
0x01335c1b
0x01335c1e
0x00000000
0x00000000
0x012f28c3
0x012f28c8
0x012f28d2
0x012f28d4
0x012f28d8
0x012f28db
0x01335c26
0x01335c28
0x01335c2d
0x01335c2d
0x00000000
0x00000000
0x01335c34
0x01335c36
0x01335c49
0x01335c4e
0x01335c54
0x01335c5b
0x01335c5d
0x01335c60
0x012f2788
0x012f2788
0x012f278b
0x012f278e
0x012f278e
0x012f278e
0x012f2791
0x00000000
0x00000000
0x012f2756
0x012f2750
0x00000000
0x012f2794
0x012f2794
0x012f2795
0x012f2798
0x012f2798
0x00000000
0x012f2734
0x012f272c
0x012f2700
0x012f25ef
0x012f25ef
0x012f25ef
0x012f25f2
0x012f25f8
0x00000000
0x00000000
0x012f25fe
0x00000000
0x012f28e6
0x012f28ec
0x012f28ef
0x012f28f5
0x012f28f8
0x012f28f8
0x00000000
0x012f28f8
0x00000000
0x00000000
0x012f2866
0x012f2866
0x012f2876
0x012f2879
0x00000000
0x00000000
0x012f27e0
0x012f27e7
0x012f27e9
0x012f27eb
0x01335afd
0x00000000
0x01335afd
0x00000000
0x00000000
0x012f2633
0x012f2638
0x012f263b
0x012f263c
0x012f263e
0x012f2640
0x012f2642
0x012f2647
0x012f2649
0x012f264e
0x012f2650
0x012f2653
0x012f2659
0x012f26a2
0x012f26a7
0x012f26ac
0x012f26b2
0x01335b11
0x01335b15
0x01335b17
0x00000000
0x012f26b8
0x012f26b8
0x012f26ba
0x012f27a6
0x012f27a6
0x012f27a9
0x012f27ab
0x012f27b9
0x012f27b9
0x012f27be
0x012f27c1
0x012f27c3
0x012f27c5
0x012f27c7
0x01335c74
0x01335c79
0x01335c79
0x012f27c7
0x00000000
0x012f26c0
0x012f26c0
0x012f26c3
0x012f26c6
0x012f26c6
0x012f26c9
0x012f26c9
0x00000000
0x012f26c9
0x012f26ba
0x012f265b
0x012f265b
0x012f265e
0x012f2667
0x012f266d
0x012f2677
0x012f267c
0x012f267f
0x012f2681
0x01335b49
0x01335b4e
0x012f27cd
0x012f27d0
0x012f27d1
0x012f27d2
0x012f27d4
0x012f27dd
0x012f2687
0x012f2687
0x012f268a
0x012f268b
0x012f268e
0x012f268f
0x012f2691
0x012f2696
0x012f2698
0x012f269d
0x012f269f
0x00000000
0x012f269f
0x012f2681
0x00000000
0x00000000
0x012f2846
0x00000000
0x00000000
0x012f2605
0x012f260a
0x012f260c
0x012f2611
0x012f2616
0x012f2619
0x012f2619
0x012f261e
0x00000000
0x012f2624
0x012f2627
0x012f2627
0x00000000
0x00000000
0x01335b1f
0x00000000
0x00000000
0x012f2894
0x012f289b
0x012f289d
0x012f28a1
0x01335b2b
0x01335b2e
0x01335b2e
0x012f28a7
0x012f28a9
0x01335b04
0x01335b09
0x01335b09
0x01335b09
0x00000000
0x00000000
0x01335b35
0x01335b3c
0x012f28fb
0x012f28fb
0x012f26cc
0x012f26cc
0x012f26d0
0x00000000
0x012f26d2
0x012f26d2
0x00000000
0x012f26d2
0x00000000
0x00000000
0x012f25fe
0x012f292d
0x012f292f
0x012f2930
0x012f2935
0x012f2937
0x012f2938
0x012f293b
0x012f293c
0x012f293e
0x012f293f
0x012f2940
0x012f2942
0x012f2944
0x012f2947
0x012f2948
0x012f294e
0x012f2951
0x012f2951
0x012f2952
0x012f2954
0x012f295a
0x012f295c
0x012f2962
0x012f2963
0x012f2964
0x012f2966
0x012f2968
0x012f296b
0x012f296c
0x012f296f
0x012f2972
0x012f2977
0x012f2978
0x012f297d
0x012f297e
0x012f297f
0x012f2980
0x012f2981
0x012f2982
0x012f2983
0x012f2984
0x012f2985
0x012f2986
0x012f2987
0x012f2988
0x012f2989
0x012f298a
0x012f298b
0x012f298c
0x012f298d
0x012f298e
0x012f298f
0x012f2990
0x012f2992
0x012f2997
0x012f29a3
0x012f29a6
0x012f29ab
0x012f29ad
0x012f29b0
0x012f29b2
0x01335c80
0x012f29b8
0x012f29b8
0x012f29bb
0x012f29c0
0x012f29c5
0x012f29c6
0x012f29c6
0x012f29c9
0x012f29cb
0x00000000
0x00000000
0x012f29cd
0x012f29d0
0x012f29d9
0x012f29db
0x012f29dd
0x012f2a7f
0x012f2a84
0x012f2a87
0x012f2a89
0x01335ca1
0x01335ca3
0x00000000
0x012f2a8f
0x012f2a8f
0x00000000
0x012f2a8f
0x00000000
0x012f29e3
0x012f29e3
0x012f29e3
0x00000000
0x012f29e3
0x012f29dd
0x00000000
0x012f29db
0x012f29e6
0x012f29e9
0x012f29eb
0x012f29ed
0x012f29f3
0x012f29f5
0x012f29f8
0x012f29fa
0x012f2a97
0x012f2a9a
0x012f2a9d
0x012f2add
0x00000000
0x012f2a9f
0x012f2aa2
0x012f2aa5
0x012f2aa8
0x012f2aab
0x01335cab
0x01335caf
0x01335cc5
0x01335cda
0x01335cdc
0x01335cdf
0x01335ce5
0x00000000
0x01335ceb
0x01335ced
0x01335cee
0x00000000
0x01335cee
0x01335cb1
0x01335cb4
0x01335cb9
0x01335cbb
0x00000000
0x01335cbd
0x01335cbd
0x00000000
0x01335cbd
0x01335cbb
0x012f2ab1
0x012f2ab1
0x012f2ac4
0x012f2ac6
0x012f2ac6
0x00000000
0x012f2ac6
0x012f2aab
0x00000000
0x012f2a00
0x012f2a09
0x012f2a0e
0x012f2a21
0x012f2a24
0x012f2a35
0x012f2a3a
0x012f2a3d
0x012f2a42
0x012f2a59
0x012f2a59
0x012f2a5c
0x012f2a5f
0x012f2a5f
0x012f29fa
0x012f29f3
0x012f2a64
0x012f2a64
0x012f2a6b
0x012f2a6b
0x012f2a6d
0x012f2a72
0x012f2a72
0x00000000

Strings

PATH, xrefs: 012F2642, 012F2691

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 8494966255c402124fd99c7a6650475fa05133fbb1780de0e7569a3141e2c3b5
Instruction ID: f4de659b8e6f6f4b396801b92a7b9c9ddad8146dd7b3ed4638e76acce77c2948
Opcode Fuzzy Hash: 8494966255c402124fd99c7a6650475fa05133fbb1780de0e7569a3141e2c3b5
Instruction Fuzzy Hash: D5C18E71D2020ADBDB29DF99D881AAEFBB4FF49714F14402DE601AB290E774E841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012FFAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E012FFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E012DEEF0(0x13b7b60);
					_t134 =  *0x13b7b84; // 0x77f07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x13b7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x13b7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E012D6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E012D76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E01368938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E012CB150();
													}
													_t116 = E01366D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E012D75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x13b8638; // 0xd967b8
																	_t122 = L012D38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E012D76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E012D76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L012FFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L012D70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E012FFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E012FFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E012FFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E012FFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E012FFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x13b7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x13b7b84 = _t75;
						_t73 = E012DEB70(_t134, 0x13b7b60);
						if( *0x13b7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E012DFF60( *0x13b7b20);
							}
						}
						goto L5;
					}
				}
			}

0x012ffab0
0x012ffab2
0x012ffab3
0x012ffab4
0x012ffabc
0x012ffac0
0x012ffb14
0x012ffb17
0x012ffac2
0x012ffac8
0x012ffacd
0x012ffad3
0x012ffad3
0x012ffadd
0x012ffb18
0x012ffb1b
0x012ffb1d
0x012ffb1e
0x012ffb1f
0x012ffb20
0x012ffb21
0x012ffb22
0x012ffb23
0x012ffb24
0x012ffb25
0x012ffb26
0x012ffb27
0x012ffb28
0x012ffb29
0x012ffb2a
0x012ffb2b
0x012ffb2c
0x012ffb2d
0x012ffb2e
0x012ffb2f
0x012ffb3a
0x012ffb3b
0x012ffb3e
0x012ffb41
0x012ffb44
0x012ffb47
0x012ffb4a
0x012ffb4d
0x012ffb53
0x0133bdcb
0x0133bdcb
0x012ffb59
0x012ffb5b
0x012ffb5b
0x012ffb5e
0x0133bdd5
0x0133bdd8
0x00000000
0x0133bdda
0x00000000
0x0133bdda
0x012ffb64
0x012ffb64
0x012ffb64
0x012ffb67
0x012ffb6e
0x012ffb70
0x012ffb72
0x00000000
0x012ffb78
0x012ffb7a
0x012ffb7a
0x012ffb7d
0x012ffb80
0x0133bddf
0x0133bde1
0x00000000
0x0133bde3
0x00000000
0x0133bde3
0x012ffb86
0x012ffb86
0x012ffb86
0x012ffb8b
0x012ffb90
0x012ffb92
0x012ffb94
0x012ffb9a
0x012ffb9b
0x012ffba1
0x0133bde8
0x0133bdeb
0x0133bded
0x0133beb5
0x0133beb5
0x0133bebb
0x0133bebd
0x0133bec3
0x0133bed2
0x0133bedd
0x0133bedd
0x0133beed
0x00000000
0x0133bdf3
0x0133bdfe
0x0133be06
0x0133be0b
0x0133be0d
0x0133be0f
0x0133be14
0x0133be19
0x0133be20
0x0133be25
0x0133be27
0x0133be35
0x0133be39
0x0133be46
0x0133be4f
0x0133be54
0x0133be56
0x0133bef8
0x0133bef8
0x00000000
0x0133be5c
0x0133be5c
0x0133be60
0x00000000
0x0133be66
0x0133be66
0x0133be7f
0x0133be84
0x0133be87
0x0133be89
0x0133be8b
0x0133be99
0x0133be9d
0x0133bea0
0x0133beac
0x0133beaf
0x0133beb1
0x0133beb3
0x0133beb3
0x00000000
0x0133bea2
0x0133bea2
0x00000000
0x0133bea2
0x0133be8d
0x0133be8d
0x0133be92
0x00000000
0x0133be92
0x0133be8b
0x0133be60
0x0133be3b
0x0133be3b
0x0133be3e
0x00000000
0x0133be40
0x0133be40
0x0133be44
0x00000000
0x00000000
0x00000000
0x00000000
0x0133be44
0x0133be3e
0x0133be29
0x0133be29
0x00000000
0x0133be29
0x0133be27
0x00000000
0x012ffba7
0x012ffba7
0x012ffbab
0x0133bf02
0x012ffbb1
0x012ffbb1
0x012ffbb8
0x012ffbbd
0x012ffbbd
0x012ffbbf
0x012ffbbf
0x012ffbc5
0x012ffbcb
0x012ffbf8
0x012ffbf8
0x012ffbfa
0x00000000
0x012ffc00
0x012ffc00
0x012ffc03
0x00000000
0x012ffc09
0x012ffc09
0x012ffc0f
0x012ffc15
0x012ffc23
0x012ffc23
0x012ffc25
0x012ffc27
0x012ffc75
0x012ffc7c
0x012ffc84
0x00000000
0x012ffc29
0x012ffc29
0x012ffc2d
0x012ffc30
0x0133bf0f
0x00000000
0x012ffc36
0x012ffc38
0x012ffc3b
0x012ffc41
0x0133bf17
0x0133bf19
0x0133bf48
0x0133bf4b
0x00000000
0x0133bf1b
0x0133bf22
0x0133bf24
0x0133bf26
0x00000000
0x0133bf2c
0x0133bf37
0x0133bf39
0x0133bf3b
0x00000000
0x0133bf41
0x0133bf41
0x0133bf41
0x0133bf41
0x0133bf45
0x00000000
0x0133bf45
0x0133bf3b
0x0133bf26
0x00000000
0x012ffc47
0x012ffc47
0x012ffc49
0x012ffcb2
0x012ffcb4
0x012ffcb6
0x012ffcdc
0x012ffcdc
0x00000000
0x012ffcb8
0x012ffcc3
0x012ffcc5
0x012ffcc7
0x00000000
0x012ffcc9
0x012ffcc9
0x012ffccd
0x00000000
0x012ffccd
0x012ffcc7
0x00000000
0x012ffc4b
0x012ffc4b
0x012ffc4e
0x012ffc4e
0x012ffc51
0x012ffc51
0x012ffc54
0x012ffc5a
0x012ffc5c
0x012ffc5f
0x012ffc61
0x012ffc63
0x012ffc65
0x012ffc67
0x012ffc6e
0x012ffc72
0x012ffc72
0x012ffc72
0x012ffc72
0x012ffc67
0x012ffc61
0x00000000
0x012ffc5a
0x012ffc49
0x012ffc41
0x012ffc30
0x012ffc27
0x012ffc03
0x012ffbcd
0x012ffbd3
0x012ffbd9
0x012ffbdc
0x012ffbde
0x012ffc99
0x012ffc9b
0x012ffc9d
0x012ffcd5
0x012ffcd5
0x012ffc89
0x012ffc89
0x00000000
0x012ffc9f
0x012ffc9f
0x012ffca3
0x00000000
0x012ffca3
0x00000000
0x012ffbe4
0x012ffbe4
0x012ffbe4
0x012ffbe4
0x012ffbe9
0x012ffbf2
0x00000000
0x012ffbf2
0x012ffbde
0x012ffbcb
0x012ffbab
0x012ffc8b
0x012ffc8b
0x012ffc8c
0x012ffb80
0x012ffb72
0x012ffb5e
0x012ffc8d
0x012ffc91
0x012ffadf
0x012ffadf
0x012ffae1
0x012ffae4
0x012ffae7
0x012ffaec
0x012ffaf8
0x012ffb00
0x012ffb07
0x012ffb0f
0x012ffb0f
0x012ffb07
0x00000000
0x012ffaf8
0x012ffadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0133BE0F

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: d725692eaaf748019d6587c5a822b3d2403343c6a4b6e6f6544a1386e5f30b6f
Instruction ID: cc48afb8e6f4adba6078d5cd3620f267142639f26746fd9da5d57fa5fc340ba5
Opcode Fuzzy Hash: d725692eaaf748019d6587c5a822b3d2403343c6a4b6e6f6544a1386e5f30b6f
Instruction Fuzzy Hash: A9A11372B206168BEB25CF6CC590B7AF7A4AF88714F04457DEB06CB694EB74D841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012C2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E012C2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x13b5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x13b7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E013097C0();
				}
				if( *0x13b79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x13b79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E012F1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E012E7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0135FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E01309520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E012FE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0131DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x13b6901;
								_push(_t109);
								_v52 = _t98;
								if( *0x13b6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E01309980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E013095D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E012E7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E012E7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E01347016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0135FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x13b5350;
							if(_t109 != 0x13b5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0135FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E01355720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x012c2d8a
0x012c2d8a
0x012c2d92
0x012c2d96
0x012c2d9e
0x012c2da0
0x012c2da3
0x012c2da5
0x012c2da8
0x012c2dab
0x012c2db2
0x0131f9aa
0x0131f9ab
0x0131f9ae
0x0131f9ae
0x012c2db8
0x012c2dc2
0x0131f9b9
0x0131f9be
0x0131f9bf
0x0131f9bf
0x012c2dcf
0x0131f9c9
0x012c2dd5
0x012c2dd5
0x012c2dd5
0x012c2dde
0x012c2de1
0x012c2e70
0x012c2e72
0x012c2e72
0x012c2de7
0x012c2deb
0x012c2e7c
0x012c2e83
0x012c2e85
0x012c2e8b
0x012c2e8d
0x012c2e92
0x012c2e92
0x012c2e85
0x012c2df1
0x012c2df7
0x012c2df9
0x012c2df9
0x012c2dfc
0x012c2dff
0x012c2e02
0x00000000
0x012c2e05
0x012c2e0c
0x0131f9d9
0x012c2e12
0x012c2e12
0x012c2e12
0x012c2e1a
0x0131f9e3
0x0131f9e9
0x0131f9f0
0x0131f9f6
0x0131f9f8
0x0131f9f8
0x0131f9f0
0x012c2e23
0x0131fa02
0x0131fa03
0x0131fa05
0x0131fa06
0x00000000
0x012c2e29
0x012c2e29
0x012c2e2e
0x012c2e34
0x012c2e3e
0x00000000
0x00000000
0x012c2e44
0x012c2e47
0x012c2e4d
0x00000000
0x00000000
0x012c2e4f
0x012c2e54
0x00000000
0x00000000
0x012c2e5a
0x012c2e5f
0x012c2e9a
0x012c2ea4
0x012c2ea5
0x012c2ea8
0x012c2eaf
0x012c2eb2
0x012c2eb5
0x0131fae9
0x0131faeb
0x0131faed
0x0131faef
0x0131faf7
0x0131faf8
0x0131fafd
0x0131faff
0x0131fb04
0x0131fb04
0x0131faff
0x012c2ec0
0x012c2ec4
0x012c2ec6
0x012c2ec8
0x0131fb14
0x0131fb18
0x0131fb1e
0x0131fb21
0x0131fb21
0x012c2ece
0x012c2ece
0x012c2ece
0x012c2ed7
0x012c2e61
0x012c2e63
0x0131fa6b
0x0131fa71
0x0131fa76
0x0131fa78
0x0131fa8a
0x0131fa7a
0x0131fa83
0x0131fa83
0x0131fa8f
0x0131fa91
0x0131fa97
0x0131fa9d
0x0131faa4
0x0131faaa
0x0131faaf
0x0131fab1
0x0131fac3
0x0131fab3
0x0131fabc
0x0131fabc
0x0131fac8
0x0131facb
0x0131fadf
0x0131fadf
0x0131facb
0x0131faa4
0x0131fa91
0x012c2e6f
0x012c2e6f
0x012c2e5f
0x0131fa13
0x0131fa15
0x0131fa17
0x0131fa1f
0x0131fa21
0x0131fa22
0x0131fa25
0x0131fa28
0x0131fa2f
0x0131fa2f
0x0131fa2a
0x0131fa2a
0x0131fa2a
0x0131fa31
0x0131fa34
0x0131fa36
0x0131fa3c
0x0131fa3e
0x0131fa41
0x0131fa43
0x0131fa45
0x0131fa45
0x0131fa41
0x0131fa3c
0x0131fa4a
0x0131fa4f
0x0131fa51
0x0131fa53
0x0131fa56
0x0131fa5b
0x0131fa5e
0x00000000
0x0131fa5e
0x012c2e23

Strings

RTL: Re-Waiting, xrefs: 0131FA4A

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: a2954b68b5ab7a998fea85d757a3bc11db7f36a9f7eca6caea0359944fbb2594
Instruction ID: 9c65ecb2e4eae6f6433078a764e743ad6f6e8d3614b5b132e783fa85b6ca4bbd
Opcode Fuzzy Hash: a2954b68b5ab7a998fea85d757a3bc11db7f36a9f7eca6caea0359944fbb2594
Instruction Fuzzy Hash: AB613731A10645DFEB36DF6CC880B7E7BE9EB44B18F140269DB15A72C1CB74A905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01390EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E01390EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0138FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E01391074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E01309730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0138A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0138A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x13b8b04 >> 0x14) + (_v44 -  *0x13b8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E012E7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0138138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E012E7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0137FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x13b8724 & 0x00000008) != 0) {
						E013852F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E013915B5(0x13b8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x01390eb7
0x01390eb9
0x01390ec0
0x01390ec2
0x01390ecd
0x0139105b
0x0139105b
0x01391061
0x01391066
0x01391066
0x0139106b
0x01391073
0x01391073
0x01390ed3
0x01390ed6
0x01390edc
0x01390ee0
0x01390ee7
0x01390ef0
0x01390ef5
0x01390efa
0x01390efc
0x01390efd
0x01390f03
0x01390f04
0x01390f06
0x01390f07
0x01390f09
0x01390f0e
0x01390f14
0x01390f23
0x01390f2d
0x01390f34
0x01390f34
0x01390f14
0x01390f52
0x00000000
0x00000000
0x01390f58
0x01390f73
0x01390f74
0x01390f79
0x01390f7d
0x01390f80
0x01390f86
0x01390fab
0x01390fb5
0x01390fc6
0x01390fd1
0x01390fe3
0x01390fd3
0x01390fdc
0x01390fdc
0x01390feb
0x01391009
0x01391009
0x01391015
0x01391027
0x01391017
0x01391020
0x01391020
0x0139102f
0x0139103c
0x0139103c
0x01391048
0x01391050
0x01391050
0x01391055
0x00000000
0x01391055
0x01390f88
0x01390f9e
0x01390fa2
0x01390fa9
0x00000000
0x00000000
0x00000000
0x01390fa9
0x00000000

Strings

`, xrefs: 01390F16

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: ec3281c7a1d6b69d01c34ecc6bce460524a152163ce3c4134a6fa5cae21b35a4
Instruction ID: c93c79fe4b9393e8103518899daf208eb72a4ba90229758b42154777861d537a
Opcode Fuzzy Hash: ec3281c7a1d6b69d01c34ecc6bce460524a152163ce3c4134a6fa5cae21b35a4
Instruction Fuzzy Hash: A751B2713043429FEB25DF28D984B1BBBE9EBC4718F04092DFA9697290D771E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 012FF0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E012FF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E012E4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E01309830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E01309990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E013095D0();
							goto L11;
						} else {
							_t109 = L012E4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E0130F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E013095D0();
										L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x012ff0d3
0x012ff0d9
0x012ff0e0
0x012ff0e7
0x012ff0f2
0x012ff0f4
0x012ff0f8
0x012ff100
0x012ff108
0x012ff10d
0x012ff115
0x012ff116
0x012ff11f
0x012ff123
0x012ff124
0x012ff12c
0x012ff130
0x012ff134
0x012ff13d
0x012ff144
0x012ff14b
0x012ff152
0x0133bab0
0x0133bab0
0x012ff158
0x012ff158
0x012ff15a
0x012ff160
0x012ff165
0x012ff166
0x012ff16f
0x012ff173
0x0133baa7
0x0133baa7
0x0133baab
0x00000000
0x012ff179
0x012ff18d
0x012ff191
0x0133baa2
0x00000000
0x012ff197
0x012ff19b
0x012ff1a2
0x012ff1a9
0x012ff1af
0x012ff1b2
0x012ff1b6
0x012ff1b9
0x012ff1c4
0x012ff1d8
0x012ff1df
0x012ff1e3
0x012ff1eb
0x012ff1ee
0x012ff1f4
0x012ff20f
0x0133bab7
0x0133babb
0x0133bacc
0x0133bad1
0x012ff215
0x012ff218
0x012ff226
0x012ff22b
0x00000000
0x012ff22b
0x012ff1f6
0x012ff1f6
0x012ff1f9
0x012ff1fb
0x012ff1fb
0x012ff1f4
0x012ff191
0x012ff173
0x012ff152
0x012ff203

Strings

@, xrefs: 012FF124

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 1d277d87cd824bed432633d2e8df5c4e6b0de07c5a4184816d40f47b7eccf36e
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 6B517A72514711AFD321DF29C841A6BBBF8FF88714F00892EFA9587690E7B4E914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01343540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01343540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x13bd360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E01300BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E01343706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0130FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E01343540;
						E0130FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0131DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E01350C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E013097C0();
					}
					return E0130B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E01343971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E01343884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0130FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E01309650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E01343787(_a4,  &_v352, _t80);
						}
					}
					L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E013095D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x01343552
0x0134355a
0x0134355d
0x01343566
0x01343567
0x0134357e
0x0134358f
0x013435a1
0x013435a5
0x0134366b
0x0134366b
0x0134366d
0x01343672
0x01343679
0x01343685
0x0134368d
0x0134369d
0x013436a7
0x013436b8
0x013436c6
0x013436c7
0x013436dc
0x013436e1
0x013436e7
0x013436e9
0x013436e9
0x01343703
0x01343703
0x013435b5
0x013435c0
0x013435c4
0x00000000
0x00000000
0x013435ca
0x013435d7
0x013435e2
0x013435e6
0x013435e8
0x013435f5
0x013435fa
0x01343603
0x01343604
0x01343609
0x0134360a
0x01343612
0x01343613
0x0134361e
0x01343622
0x01343628
0x0134362f
0x0134362f
0x01343636
0x01343638
0x0134363b
0x01343642
0x01343642
0x01343636
0x01343657
0x01343657
0x0134365c
0x01343662
0x01343669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 0134358F

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 1d810712da27c50825571f4417e9be944d4b109b95d7488e418688abf6e689a7
Instruction ID: 76d2678738640a9d3f898103cfa88d7571e635d777fb134b7e12967a5db55cef
Opcode Fuzzy Hash: 1d810712da27c50825571f4417e9be944d4b109b95d7488e418688abf6e689a7
Instruction Fuzzy Hash: 3C4167B1D0052D9BDB21DA54CC80FDEB7BCAB54718F0045A5EB08A7281DB34AE88CF94

Uniqueness

Uniqueness Score: -1.00%

Function 013905AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E013905AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E013907DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E01309730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E0138A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E0138A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E01391293(_t79, _v40, E013907DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E012E7D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E0138138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x013905c5
0x013905ca
0x013905d3
0x013906db
0x013906db
0x013906dd
0x013906e3
0x013906e3
0x013905dd
0x013905e7
0x013905f6
0x01390600
0x01390607
0x01390610
0x01390615
0x0139061a
0x0139061c
0x0139061e
0x01390624
0x01390625
0x01390627
0x01390628
0x01390631
0x01390640
0x0139064d
0x01390654
0x01390654
0x01390631
0x0139066d
0x01390674
0x00000000
0x00000000
0x01390692
0x0139069e
0x013906b0
0x013906a0
0x013906a9
0x013906a9
0x013906b8
0x013906d6
0x013906d6
0x00000000

Strings

`, xrefs: 01390633

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 72d979d557a67694706319508b19b8cb7316befe196d8ac25a7ad8142df59588
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: AB31B0326043466BEB14DE29CD45F9A7BDDEBC4768F144229BA58AB280D770E904CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 01343884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01343884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E01309650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L012E4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E01309650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x01343893
0x01343896
0x01343899
0x0134389f
0x013438a0
0x013438a4
0x013438a9
0x013438ac
0x013438ad
0x013438ae
0x013438af
0x013438b1
0x013438b4
0x013438bb
0x013438bc
0x013438bd
0x013438c4
0x013438c8
0x013438ca
0x013438ca
0x013438d5
0x0134393e
0x01343940
0x01343942
0x01343952
0x01343954
0x01343961
0x01343961
0x01343967
0x0134396e
0x0134396e
0x01343947
0x0134394c
0x00000000
0x0134394c
0x013438ea
0x013438ee
0x013438f8
0x013438f9
0x013438ff
0x01343900
0x01343902
0x01343903
0x0134390b
0x0134390f
0x01343950
0x00000000
0x01343950
0x01343915
0x0134391d
0x0134391d
0x01343922
0x01343926
0x00000000
0x01343928
0x0134392b
0x0134392b
0x01343935
0x01343937
0x01343937
0x00000000
0x01343935
0x01343926
0x013438f0
0x00000000

Strings

BinaryName, xrefs: 013438B4

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 7e4d25aaaea92ae5aafd0c6f4d2cd7aecad01435a1fb519465c2235fa685d0ca
Instruction ID: 74b259491bf3f18dbe125e648b60a387b498e51bb441e70516b7a9ef8ae31649
Opcode Fuzzy Hash: 7e4d25aaaea92ae5aafd0c6f4d2cd7aecad01435a1fb519465c2235fa685d0ca
Instruction Fuzzy Hash: F031E53690052ABFEB15DA5CC945E7BFBF4FF40728F014169E915A7291D730AE04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 012FD294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E012FD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x13bd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E012E4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0130B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E013098D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E013095D0();
					L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x012fd29c
0x012fd2a6
0x012fd2b1
0x012fd2b5
0x012fd2b6
0x012fd2bc
0x012fd2bd
0x012fd2be
0x012fd2bf
0x012fd2c2
0x012fd2c4
0x012fd2cc
0x012fd384
0x012fd34b
0x012fd34f
0x012fd350
0x012fd351
0x012fd35c
0x012fd35c
0x012fd2d6
0x012fd2da
0x012fd2e1
0x012fd361
0x012fd369
0x012fd36d
0x012fd2e3
0x012fd2e3
0x012fd2e3
0x012fd2e5
0x012fd2ed
0x012fd2f5
0x012fd2fa
0x012fd302
0x012fd303
0x012fd30b
0x012fd30f
0x012fd313
0x012fd318
0x012fd31c
0x012fd320
0x012fd379
0x012fd37d
0x00000000
0x00000000
0x0133affe
0x0133b001
0x0133b011
0x00000000
0x012fd322
0x012fd322
0x012fd330
0x012fd337
0x012fd35d
0x012fd339
0x012fd33f
0x012fd38c
0x012fd38c
0x012fd33f
0x012fd349
0x00000000
0x012fd349

Strings

@, xrefs: 012FD303

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 96261d1e7c46bd0a838f5e75ac94881138ecc72c727819481ec4ddc75f98b723
Instruction ID: 1af43cb96eb2f25d9fe40ca478b209d78bc7d6154d60c608bb6272739d1b2e60
Opcode Fuzzy Hash: 96261d1e7c46bd0a838f5e75ac94881138ecc72c727819481ec4ddc75f98b723
Instruction Fuzzy Hash: DF31C2B656830A9FC721DF68C981A6BFBE8EB85654F00093EFB9483251D634DD04CF92

Uniqueness

Uniqueness Score: -1.00%

Function 012D1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E012D1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0130BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0130A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0130A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L012E77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L012E4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x012d1b8f
0x012d1b9a
0x012d1b9c
0x012d1b9e
0x012d1ba3
0x01327010
0x01327010
0x00000000
0x012d1ba9
0x012d1ba9
0x012d1bae
0x00000000
0x012d1bc5
0x012d1bca
0x012d1bcf
0x012d1bd0
0x012d1bd1
0x012d1bd2
0x012d1bd6
0x012d1bdc
0x012d1be0
0x01326ffc
0x01327000
0x00000000
0x01327006
0x01327009
0x01327009
0x012d1be6
0x012d1bec
0x012d1c0b
0x012d1c0b
0x012d1c0c
0x012d1c11
0x012d1c12
0x012d1c15
0x012d1c1b
0x012d1c1f
0x012d1c31
0x012d1c33
0x01327026
0x01327026
0x012d1c21
0x012d1c24
0x012d1c24
0x012d1bee
0x012d1bee
0x012d1bf2
0x012d1c3a
0x012d1bf4
0x012d1bf4
0x012d1c05
0x012d1c05
0x012d1c09
0x012d1c3e
0x00000000
0x00000000
0x00000000
0x012d1c09
0x012d1bec
0x012d1be0
0x012d1bae
0x012d1c2e

Strings

WindowsExcludedProcs, xrefs: 012D1BC5

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 911fd948c49720e6356de2822ca6d886608cb9b185f56ad3401f3f193876cc36
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 9221267B620229ABDB22AA5DC840F6BBBADEF51A54F058425FE04DB600D634DC10C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 012EF716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012EF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x012ef71d
0x012ef722
0x012ef726
0x01334770
0x012ef765
0x012ef769
0x012ef769
0x012ef732
0x0133477a
0x00000000
0x0133477a
0x012ef738
0x012ef73a
0x012ef73c
0x012ef73f
0x012ef746
0x012ef778
0x012ef7a9
0x012ef7a9
0x012ef754
0x012ef75a
0x012ef75d
0x012ef75f
0x012ef761
0x012ef76f
0x012ef771
0x012ef771
0x012ef76f
0x012ef763
0x00000000
0x012ef763
0x012ef77d
0x012ef7a3
0x012ef7a5
0x00000000
0x012ef7a5
0x012ef77f
0x012ef782
0x012ef784
0x012ef786
0x00000000
0x00000000
0x00000000
0x012ef788
0x012ef748
0x012ef74d
0x012ef78d
0x012ef793
0x012ef7b7
0x012ef7bc
0x00000000
0x012ef7bc
0x012ef798
0x00000000
0x00000000
0x012ef79d
0x012ef7b0
0x00000000
0x012ef7b0
0x012ef79f
0x00000000
0x012ef74f
0x012ef74f
0x00000000
0x012ef74f

Strings

Actx , xrefs: 012EF73F

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: e144562db8c4228058358871919d79170cb605dbf1c085ff5ea9ee5d61f0bb8a
Instruction ID: 364912439119a1ebe69f49c24c3f20055edd81542301393759ed51ecb537c226
Opcode Fuzzy Hash: e144562db8c4228058358871919d79170cb605dbf1c085ff5ea9ee5d61f0bb8a
Instruction Fuzzy Hash: FA11B6353B47038BEB2D4E1D8B9973676D6EB85624FA5452AEA65CB391D7B0C840C340

Uniqueness

Uniqueness Score: -1.00%

Function 01378DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01378DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x13a0d50);
				E0131D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E01355720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0131DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0131DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0131D130(_t34, _t39, _t40);
			}

0x01378df1
0x01378df1
0x01378df1
0x01378df1
0x01378df1
0x01378df1
0x01378df3
0x01378df8
0x01378dfd
0x01378e00
0x01378e0e
0x01378e2a
0x01378e36
0x01378e38
0x01378e3c
0x01378e46
0x01378e46
0x01378e36
0x01378e50
0x01378e56
0x01378e59
0x01378e5c
0x01378e60
0x01378e67
0x01378e6d
0x01378e73
0x01378e74
0x01378eb1
0x01378ebd

Strings

Critical error detected %lx, xrefs: 01378E21

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 0f4e4b2789a56ee0c3d4bfa616734faf556dcf74f29f943d38697c9c13768747
Instruction ID: 238d73d65e5f6e9f1f3cc44f1485d4fa9ce43ae0f331a0b285f32e88717324d0
Opcode Fuzzy Hash: 0f4e4b2789a56ee0c3d4bfa616734faf556dcf74f29f943d38697c9c13768747
Instruction Fuzzy Hash: 72115B75D15348EADF29CFA885097DCBBB0BB15359F24465DE52D6B682C3381601CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0135FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0135FF60

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: b325dc2d0fc4e68944212bc7a7d24175b6b544ebcceb220af2e02e23ed443ca2
Instruction ID: 25fd731dad0387685315aecb229341043b4cab031b98e6856db2800b60ecb4fd
Opcode Fuzzy Hash: b325dc2d0fc4e68944212bc7a7d24175b6b544ebcceb220af2e02e23ed443ca2
Instruction Fuzzy Hash: 9B112671550144EFDF66DF58C988F98BBB5FF05B08F148058FA0857AA1C7389944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01395BA5, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e64935c42c32ee5b46da7fd440a439598d3a5c3c3a96fe68fc6de5f64fa4730
Instruction ID: 527eac014dee62a4157387fb0c9d0496986dcba8fae2e808bb21b5663f5c9401
Opcode Fuzzy Hash: 7e64935c42c32ee5b46da7fd440a439598d3a5c3c3a96fe68fc6de5f64fa4730
Instruction Fuzzy Hash: 2D425AB1D01229CFDF25CF68C881BA9BBB5FF49308F1481AAD94DAB252D7349985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012E4120, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868c3ad9a2544164613e437a274261403c3b06bac6b19b697e2bea98abe73616
Instruction ID: dce5a594fddad1ec4f5527fda3194c9b93c9fc1bcc2d18f845708fa60f4c5817
Opcode Fuzzy Hash: 868c3ad9a2544164613e437a274261403c3b06bac6b19b697e2bea98abe73616
Instruction Fuzzy Hash: 73F1B0706283528FC724EF18C485A7AB7E1FF99718F94492EF586CB291E734D881CB52

Uniqueness

Uniqueness Score: -1.00%

Function 012F20A0, Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b6423d918636b8d9e50b92f19aabce898b605562288fb1fffbba2e4d1872fb
Instruction ID: fd5671f0dd99e35dc57df20630a0503f5fd36be3a482edef4672709d8fd8c7fd
Opcode Fuzzy Hash: 67b6423d918636b8d9e50b92f19aabce898b605562288fb1fffbba2e4d1872fb
Instruction Fuzzy Hash: 4FF1F575618342DFE726CB2CC48076BBBE5ABC6328F04852DEB958B281D774D841CB86

Uniqueness

Uniqueness Score: -1.00%

Function 012DD5E0, Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedf39e14f9d0da65e42ef9dbf9019c04772756fd76e83d784cc47696db2837e
Instruction ID: f4226dc1b84e33ad02aa50660401f61e244c425246e101b5ab765e29fe25f667
Opcode Fuzzy Hash: eedf39e14f9d0da65e42ef9dbf9019c04772756fd76e83d784cc47696db2837e
Instruction Fuzzy Hash: F6E1D230A1075ACFEB35DF68C880BA9B7B5BF45308F0501E9DA09AB2C5D774A981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012D849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e502f9845995428c1c0555ddebbfd9b3c4892e8609775785b568434cd7d803
Instruction ID: d8fdfce1048655501038db448aae60f674f27a2f5eff0e0187134c7135882321
Opcode Fuzzy Hash: 28e502f9845995428c1c0555ddebbfd9b3c4892e8609775785b568434cd7d803
Instruction Fuzzy Hash: 2CB16E74E2025ADFDB19DF99C984AADBBB9FF48308F10412DE605AB345D770A941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012F513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5bfe7f0647793d8f3f2a51c5b3b8b87824e232c850fc8f1de1021f22cd1bef
Instruction ID: 35c5ab7befe460a589d6d56151216a25a6885c380a77eb1d85b36f33586a2d69
Opcode Fuzzy Hash: 5e5bfe7f0647793d8f3f2a51c5b3b8b87824e232c850fc8f1de1021f22cd1bef
Instruction Fuzzy Hash: 59C153B55083819FD354CF28C581A6AFBF1BF88308F184A6EF9998B352D370E945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 012F03E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c58de7c9ebe2c28d10e6fb3a173704e648c3fdd58c7a885ef1816bff18733b
Instruction ID: aa67849905d9884f1e5480309581b5f4dca938a206fb1b7cdb22a3d4ddc96932
Opcode Fuzzy Hash: 71c58de7c9ebe2c28d10e6fb3a173704e648c3fdd58c7a885ef1816bff18733b
Instruction Fuzzy Hash: 8A912931E10259AFEB329B6CC848BADBBE5EB41718F050279FB11A72D2D7749C00C799

Uniqueness

Uniqueness Score: -1.00%

Function 012CC600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035c7657f6938f156c8c0b79cf67359e21756ae032bca983422995f01c4562d7
Instruction ID: c973a94c5d110b43e9634dc84aa5cbbb13da93cefdea955d088fb622cf5e88a9
Opcode Fuzzy Hash: 035c7657f6938f156c8c0b79cf67359e21756ae032bca983422995f01c4562d7
Instruction Fuzzy Hash: 9881B3B56142068FEB2ACE58C880F3A77E8EBC4358F14491EEE458B751D330DD41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0135B8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b054fff3aee8d874066e987d72683d0cb5fbb1621bae272e39ae8c5f913c4f
Instruction ID: b832fc79b41e5d65fd7b8af6e3fcb948de64954e253ab52e5df33c69a0bbea8c
Opcode Fuzzy Hash: c1b054fff3aee8d874066e987d72683d0cb5fbb1621bae272e39ae8c5f913c4f
Instruction Fuzzy Hash: E271FE32200706EFE7728F19C845F66BBF6EB40B28F154528EA598B6E5DB71E940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01346DC9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 8c75664ae6c1d853848036535b4a763d5eb31f7a29f55ec73759f727b1b25a8f
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 96716CB1A0020AEFDB11DFA9C984EEEBBF9FF48714F144169E505E7250DB30AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012C52A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deae486aed4a92fe6b6d3ed1b6ee1d7bc8662b60429eec2aaea64e424bf9a0ca
Instruction ID: 1034b555865b5985450651cecb671459183fde6e29033fed66489e4d47445513
Opcode Fuzzy Hash: deae486aed4a92fe6b6d3ed1b6ee1d7bc8662b60429eec2aaea64e424bf9a0ca
Instruction Fuzzy Hash: 6C51F031255742ABD325EF28C841B27BBE5FF90B18F14091EF69987691E7B0F844C792

Uniqueness

Uniqueness Score: -1.00%

Function 012F2AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddfd094351e9277c52d3fee827cae0be5ab0a8e695289df2c0885eda1d28ef9c
Instruction ID: 778527a73a2e038713042e09ac364bcf19512d60e9ccba664b3a3bf7f19cd768
Opcode Fuzzy Hash: ddfd094351e9277c52d3fee827cae0be5ab0a8e695289df2c0885eda1d28ef9c
Instruction Fuzzy Hash: 5551B076A20119CFCB14CF1CC491ABDB7B5FB89700B16846EEE46AB355E734EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0138AE44, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e155dc738fd533af040f6207aaf4c4349f564248c626637791cc386492c9f31
Instruction ID: 0999e850dd4f39f05870258f7747b5b809a7ee1fc57d15096c95aafad44bc66b
Opcode Fuzzy Hash: 4e155dc738fd533af040f6207aaf4c4349f564248c626637791cc386492c9f31
Instruction Fuzzy Hash: CA4117B17043119BE726EB2DCC84B3BBB99EF84628F04461AF95AC76D0D774E805D690

Uniqueness

Uniqueness Score: -1.00%

Function 012EDBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bbd2430c6cb495fedba160dc3576b64647016c38e62c2a759b6eccb6d298e2c
Instruction ID: 762e56e8f8f11abf392ad492455443812dbd5b0aaed512a43c1a5567b34a4511
Opcode Fuzzy Hash: 8bbd2430c6cb495fedba160dc3576b64647016c38e62c2a759b6eccb6d298e2c
Instruction Fuzzy Hash: 9E51B072E1020ACFCB15CFACC494AAEFBF5BF48350F64815AD659A7340EB71A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012DEF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: cc4c19f7220b2bffd12d0626ffc9a415387ded2641aa66b1f34ad7edc950dc92
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 5D511530E24246DFEB21CB6CC1C17AEFBB1AF05314F1881E8C6565B286C3B5A98AC751

Uniqueness

Uniqueness Score: -1.00%

Function 0139740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 1f2cc733e7bde21adeb8d218c1e6fe07898ff091c0befe943952974c84b868a2
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: C8516C71610646EFDB26CF18C480A56BBF5FF45308F1480AAE9089F252E771E946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012F2990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed84ab65abfa2802fcc0340dd9cfae695f170dcf0bd3491f45b750a9f8aab66
Instruction ID: 429636a3b9f79ee4aa20bdc779d7fedb8ae0a623ee77057a33a054b3be7a3809
Opcode Fuzzy Hash: 7ed84ab65abfa2802fcc0340dd9cfae695f170dcf0bd3491f45b750a9f8aab66
Instruction Fuzzy Hash: 33517B7191021ADFDF26CF99C880AEEBBB5BF49354F158129EA10AB350C375D952CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 012F4BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89bb0f10ad76b3415b324047e7a02c452d4966471f5619135c57360f74c1a18
Instruction ID: 52861e5d22361dcc058e0ff94d85fb6842a6f7cb0df89416515382a2732e2f18
Opcode Fuzzy Hash: b89bb0f10ad76b3415b324047e7a02c452d4966471f5619135c57360f74c1a18
Instruction Fuzzy Hash: 2641C875A10259AFDB21EF68C941FEAB7F4EF45700F4100A9EA08AB251D774DE80CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012F4D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907f71425e03bf0e1bfb34fd890cc0953740fc088ea448084463d1b7ab6e0741
Instruction ID: 51cbbd85c01ccfa8b4da69d6fa000d4f525cf9254f5a3ec53affd774cc1e1709
Opcode Fuzzy Hash: 907f71425e03bf0e1bfb34fd890cc0953740fc088ea448084463d1b7ab6e0741
Instruction Fuzzy Hash: 1941C371A54358AFEB32EF18CC81FA7B7A9EB54614F0000ADEB4597281D7B0DE44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012D8A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a68521ca38e4c96aed186652a463e0f0ce98da59bbf8eebbf296dfd567c5ec
Instruction ID: e518f09de00b5fa3297a2cbe1475c5330767859e8ce9bfe2c2db4969c97f6369
Opcode Fuzzy Hash: 89a68521ca38e4c96aed186652a463e0f0ce98da59bbf8eebbf296dfd567c5ec
Instruction Fuzzy Hash: 19415EB5A5022D9BDB24DF59CC88AB9B7F8FB54300F1045EAD919D7252EB709E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0138AA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 194353bf16a688163e04f76785d5bb757ce598c64ba68dc1f106afe9e4d4a2fb
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: AA310632F003096BEB16AB69C845BBFFBBAEF80214F05846AE905A7651DA74CD00C690

Uniqueness

Uniqueness Score: -1.00%

Function 0138FDE2, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 1dc3611c05113f25d1a981841778d36904f10dbc08eaa76cf4ce75552462bace
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 8A31F432300745AFD722AB6CC844F6ABBEDEBC5658F184058E94ACB782DB75EC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 0138EA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: f6278403326a1034786ea7ab65589acec05c92c82e2a025bcbe0b1ac1d417276
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 8F31D2326147069BD71AEF28CC80A6BB7AAFFC4614F04492DF55687781DE34E805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013469A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da49aca25f776d9113dbf0d762bcd9c904f1475fbe5d3de74b65d7ae1c2afa3
Instruction ID: 5467dc552c519f8f98f889fbd93f82af8a6bf37525e59f15532b1adc557492f5
Opcode Fuzzy Hash: 2da49aca25f776d9113dbf0d762bcd9c904f1475fbe5d3de74b65d7ae1c2afa3
Instruction Fuzzy Hash: 2941A3B1D006099FDB15CFA9C941BFEBBF8EF49718F148169E514A7240DB70A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012C5210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b32b5bbccb9f2874c047c552db6fb9426c1843b2a3507f595e08012fc0e7dbe
Instruction ID: 803f974093660b6c8edfdc8051a9e6bbb91073911dce2abde44aeb4fe15b9026
Opcode Fuzzy Hash: 8b32b5bbccb9f2874c047c552db6fb9426c1843b2a3507f595e08012fc0e7dbe
Instruction Fuzzy Hash: 3031E531262611DBC72AAB18C881B7A7BE6FF50B68F114619F6590B5E1E760F804C791

Uniqueness

Uniqueness Score: -1.00%

Function 01303D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892e833d6cfd7d559601aca1830408ea98a3b4bf4d68892b99c16f465402625b
Instruction ID: 7d50c06a65385aa89fb58d950ec16e168c5f41b96eae5d00fecdf8fddf27718b
Opcode Fuzzy Hash: 892e833d6cfd7d559601aca1830408ea98a3b4bf4d68892b99c16f465402625b
Instruction Fuzzy Hash: 4B31CB32A01615DFD7268F2EC861A7ABBE9FF85708B05806AE949CB790E730D840C795

Uniqueness

Uniqueness Score: -1.00%

Function 012FA61C, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8de319a4d6c526914b3d83ce11926430af9a4ac9b43b4ec02d9ff3dd7d12427
Instruction ID: 437ce3336c046b2c4f34737b1640f4087e10dda67bf825ac264fedeefa9fedf3
Opcode Fuzzy Hash: e8de319a4d6c526914b3d83ce11926430af9a4ac9b43b4ec02d9ff3dd7d12427
Instruction Fuzzy Hash: 98417B75A21205DFDB18CF58C880BA9BBF1FF89708F18806DEA09AB344D774A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 012EC182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 17cff37357c040ef35e67f55b78a60fbd50b67489c4c2dfee1c96af4f130f07b
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 08316672A1054BAFDB04EBF8C494BF9FBD4BF52204F48415AC41C4B241DB74AA1ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 01347016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f1c295d04ab80f1e515c5cd1de01a56ba79cc8494700cee16ef98f46cf28f6
Instruction ID: 005157862298e604af2ca457fea9e9e9f25be558f99894d90d544c146939d80a
Opcode Fuzzy Hash: b5f1c295d04ab80f1e515c5cd1de01a56ba79cc8494700cee16ef98f46cf28f6
Instruction Fuzzy Hash: F831C0726047919FD321DF2CC840A6AB7E9FF88704F044A29F99987690E730E904CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 012FA70E, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185c22beeedb0facda93715bf5f107375235268a1be44de4854395b009bb6f6b
Instruction ID: 5ac14528d3a2d5e99111e0f53fd3bba6ddeab9082fcc155a7b239009ab306f09
Opcode Fuzzy Hash: 185c22beeedb0facda93715bf5f107375235268a1be44de4854395b009bb6f6b
Instruction Fuzzy Hash: D2319EB1720201DBD729CB18D8C1F69BBF9FBC4714F14096AE70A97A84E7B0A901CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012F61A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b3b4b3af005e5b24dcd90bc08be9b183e6e26573da83d301ebdf88a38cde7c
Instruction ID: 30c66751fa9705a1f7dd8757e8745f2a158c76b8045893818e9de632c9089dae
Opcode Fuzzy Hash: e6b3b4b3af005e5b24dcd90bc08be9b183e6e26573da83d301ebdf88a38cde7c
Instruction Fuzzy Hash: 9D317AB16157028FE360CF1DC950B2AFBE5FB88B14F05496DEA989B351E7B0E804CB95

Uniqueness

Uniqueness Score: -1.00%

Function 012CAA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677017ab87cd44250d058bd201156834107a47260bdf255699756533fd183f0e
Instruction ID: 4166f75dfd9796f9ade1cffc29c4e7a10fd6787615c8410428b81488cc17811f
Opcode Fuzzy Hash: 677017ab87cd44250d058bd201156834107a47260bdf255699756533fd183f0e
Instruction Fuzzy Hash: 6731C371A1022AABCF15AF68CD81A7FB7B9EF54B00F41446DFA05E7240E7749911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01304A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b4fceb72a71a5f68d5d0428db0008e81618e1509b927ed9556c388ef0c1fc
Instruction ID: c1c5f9db29e1c757fd3429b4838782595bc9ad384f15b89afc892f090b429265
Opcode Fuzzy Hash: 438b4fceb72a71a5f68d5d0428db0008e81618e1509b927ed9556c388ef0c1fc
Instruction Fuzzy Hash: EB314432205305DFE7229F18C984B2ABBE8FFC0718F44046DEB564BA81D770DA40CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 01308EC7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27171ece84c6c5b55c8ced11205acc5d5df8c59f21f0c023c7cb846ab47b01a
Instruction ID: 98fa7d8c9ae257a18150fd165ed6ef5971da706ad023bcc7f33c673f92897da0
Opcode Fuzzy Hash: f27171ece84c6c5b55c8ced11205acc5d5df8c59f21f0c023c7cb846ab47b01a
Instruction Fuzzy Hash: CA4181B1D0121C9FDB20CFAAD981AADFBF8FB48714F5041AEE609A7640E7705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012FE730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74871e28662b0c2b7149a27c3c0478510aa12c1334b1f29200e7ab6c12240d7
Instruction ID: eee69e128774ba7bb3889808cbb6a29cce35f48e4b01ed6d4995f05054218a4a
Opcode Fuzzy Hash: b74871e28662b0c2b7149a27c3c0478510aa12c1334b1f29200e7ab6c12240d7
Instruction Fuzzy Hash: 23318F75A24249EFD705DF58D841B9AFBE4FB09314F15826AFA08CB391D671ED80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012FBC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70b98d4840487c8aac01063d806914d26e9d33cc603278f19ba30146180a0bc
Instruction ID: 375bee2bb7d15fd7ed9909a365e707d01164089df1028dd81375cd5bf3103806
Opcode Fuzzy Hash: e70b98d4840487c8aac01063d806914d26e9d33cc603278f19ba30146180a0bc
Instruction Fuzzy Hash: ED3120B6A206069FCB21DF58C4C27A6B3B8FF18310F040078EF49DB246EB74D9058B81

Uniqueness

Uniqueness Score: -1.00%

Function 012C9100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7497a574c1208a83ed067a28f48ccf09231eacdae597969d0cdc57f5972b3e
Instruction ID: c48afdf6269f2f29b00e5c443ecf4699ddbb3e6cde39db8ed510ea8b2e512ba1
Opcode Fuzzy Hash: 2a7497a574c1208a83ed067a28f48ccf09231eacdae597969d0cdc57f5972b3e
Instruction Fuzzy Hash: 3A31E575A21246DFDF26DB6CC0897ACBBB5BB89B2CF14829DC70467241D3B4A9C0CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012F1DB5, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 02a0a191082a85e2611c9f25c90c10611aecb395f95af2ecd56a5388a8e8c52d
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 3B21A132620119EFD725CF59CC84EABFBBDEF85A40F514069EB0597210D630AE11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012E0050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b66176f7ea9c287ca50f6be61f721b333299570755f0535f783089c190d9ced
Instruction ID: e923d23db8c2ab0a7c40bb1d73054382e461b7ff609b11c882dc720e8a6e1650
Opcode Fuzzy Hash: 6b66176f7ea9c287ca50f6be61f721b333299570755f0535f783089c190d9ced
Instruction Fuzzy Hash: 7B318F31311B05CFD726CF2CC844B5AB7E5FF89714F14456DE69687A90EBB5A802CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01346C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bc93f0b74522fb0104a926051273bc39641eb522bedd49b4150d02e8f96c36
Instruction ID: bdabead817be7ef3562bed4e58f199183c3c15a122ad8079975031d3d312494f
Opcode Fuzzy Hash: f4bc93f0b74522fb0104a926051273bc39641eb522bedd49b4150d02e8f96c36
Instruction Fuzzy Hash: D2219AB1A00645AFDB15DF68D884F2AB7E8FF48704F040069F908C7791D635ED50CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 013090AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: e440a65db7a8fa1039357c4cd6da4f021b9b92440be314bf4a237779e7a97fad
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 11218371A00209EFDB22DF59C444B6AFBF8EB58318F15846AE949A7651D370ED40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012F3B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10b8e6e6540bbf66f4cb80c471278e6284a556c2c8b7fde764904c7b54e5c9a
Instruction ID: 29df72236bd0b3a48dae5c1f998df575d2b68a4f89f2a7192af3cb4519c82397
Opcode Fuzzy Hash: f10b8e6e6540bbf66f4cb80c471278e6284a556c2c8b7fde764904c7b54e5c9a
Instruction Fuzzy Hash: EE219F72A00109AFD715DF98DD81B6ABBBDFB44708F1500A8EA08EB251D375ED51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01346CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866612f61212de37f5d8936fe905fcb0a8d3aaa4281a749733f3477889ffec3b
Instruction ID: 7ca58c30673c7438d00056b2796c78fba5d0c9d391681d6326c449f311404aa6
Opcode Fuzzy Hash: 866612f61212de37f5d8936fe905fcb0a8d3aaa4281a749733f3477889ffec3b
Instruction Fuzzy Hash: B721C5B25043459FD711EF29C945F67BBECEF93644F040566FA80C7261EB34E948C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0139070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: fe36bb020c3b7c912cfb2caa94faa974ba1704a7f9f0a26a4487a8a3c6ede34c
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 4A210436204204AFDB09DF1CC884B6ABBA9EFD4364F048569F9959B381D730D909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01347794, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed2c3afc682b26669964d126f792448c20bf27661dc3b1cdc8eba2e323f79ab
Instruction ID: 2ebcb05cf37b89a4ee739979c763c2d4b1e651db71613c2bd3548d7d7ea3dcac
Opcode Fuzzy Hash: 8ed2c3afc682b26669964d126f792448c20bf27661dc3b1cdc8eba2e323f79ab
Instruction Fuzzy Hash: 0C219D72900604AFD725DF69D894E6BBBE8EF88344F100569EA0AD7690E734E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 012EAE73, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 4efd6540477eda12d9dc1cbeebc64eef23e4f5a38766236bd32638b83726a2de
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 0621D472611685DFEB269B2DC948B367BE8EF84254F0900A0ED048B692D7B5DC40C694

Uniqueness

Uniqueness Score: -1.00%

Function 012FFD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 2d107c7fea3a3bb095422b56f0e965005aabb6976b58e9669497ee916875d17d
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: A1217972A60A41DFD735CF0EC640A66F7E5EB94A10F25817EEA5987A51E730EC00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012FB390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2592307cfb15459525be716afea3020cbc64c5768dc3064454d8dc79f948a1ea
Instruction ID: 4df0845b746e33f12653e8de50383dcf2af69c2b8935c66115c0576b3b8c8f1c
Opcode Fuzzy Hash: 2592307cfb15459525be716afea3020cbc64c5768dc3064454d8dc79f948a1ea
Instruction Fuzzy Hash: 951148373611109BCB19CB19CD81A6BB29AEBC5334F24013DEF16C7790DA719C02C794

Uniqueness

Uniqueness Score: -1.00%

Function 012C9240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39c333d3fc1c38a32b4b2afeb530f84e4bfc374aa5069b0f058b702ad4c76386
Instruction ID: 9ceb267f86d8926aa117d811b42a909ff167baa9aeb8de6f945f338276c6eb2f
Opcode Fuzzy Hash: 39c333d3fc1c38a32b4b2afeb530f84e4bfc374aa5069b0f058b702ad4c76386
Instruction Fuzzy Hash: 57216D31051A02DFC726EF68CA44F29B7F9FF18708F0446ACE249976A2D734E941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 01354257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90b01452c35263a56d80b59058acd161642d887552256799ef8dfcfada70d5b
Instruction ID: 0cf876c44cca180158f196df3ff9e0d4d56b227f4734f532c8756a6090233c19
Opcode Fuzzy Hash: e90b01452c35263a56d80b59058acd161642d887552256799ef8dfcfada70d5b
Instruction Fuzzy Hash: 69215B70500605CFC7A9DF68D080A147BBDFF4575DF2182AEC6198B299FB319492CB40

Uniqueness

Uniqueness Score: -1.00%

Function 012F2397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fef41c9db5aa9d110da71e645af9eec2196d9dabb3c6f1c7bffda460aa95d05
Instruction ID: a56e6c086561369782b7afd6efd78ce269a06f44f903e60d6b9595bd4eee3f2e
Opcode Fuzzy Hash: 0fef41c9db5aa9d110da71e645af9eec2196d9dabb3c6f1c7bffda460aa95d05
Instruction Fuzzy Hash: 8D110472760301A7E730A629AC84B26F6DDEBA5720F54447EF702AB290DAB4E8458754

Uniqueness

Uniqueness Score: -1.00%

Function 013446A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: f670deea51a0c8e221a648d30b316cc404b13ad9797892de740bf8e8eaebcee5
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: BA110272504208BBCB059F5C98809BEBBF9EF95314F1080AAF944C7351DA319D51C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 012CC962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e078f4a680ae2d0d6ed6553e1fe393d302df2a7cea93369c5503aa9099a8c965
Instruction ID: 953a121b8ce9631ee6c2de0e02270802e6e69e358f413528d829e20c3eedac63
Opcode Fuzzy Hash: e078f4a680ae2d0d6ed6553e1fe393d302df2a7cea93369c5503aa9099a8c965
Instruction Fuzzy Hash: 7C11A5713106469BCB11AF3DDC8596BB7E9FBC4618F000539EA4587A91EB20EC15D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 013037F5, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cdc4be945b7c1ca32c80d4ec8bfe63172322c18968d78c55efa8b8ec7c3ada
Instruction ID: 964543a1f33afdd48db49337468848aa1eea1bddfcabb9ffb267155af2d99aa1
Opcode Fuzzy Hash: 97cdc4be945b7c1ca32c80d4ec8bfe63172322c18968d78c55efa8b8ec7c3ada
Instruction Fuzzy Hash: 89012672A416219FC33B8B1ED960E27BFEAFF81B5471540E9E9058B681D730CA05C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 012F002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 5a9b6f193c6cc3477663e1ee3bc7123f0d458b63bc69798bdb04f328408e3dd5
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 51110432221686CFE727876CD948B35BBD5EF80758F0900F8EE44877A3E369D841C668

Uniqueness

Uniqueness Score: -1.00%

Function 012D766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 87c6eab52e15002c337b249fbbe4ef13695aaa352060a9b757cc16125184c96c
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: B0018833720119AFD7209E5FCD45E6B7BADEB94A64F140538BE09CB250EA34DD0187E0

Uniqueness

Uniqueness Score: -1.00%

Function 012C9080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7944c518827a9fa34157e30335168dac65b10f9319ba95b7f050d5878b8b175
Instruction ID: 34cf85b0484e47565adc38f99e3db06ae230027b0783f3bea337d46505ef870d
Opcode Fuzzy Hash: f7944c518827a9fa34157e30335168dac65b10f9319ba95b7f050d5878b8b175
Instruction Fuzzy Hash: 2301F472521205CFC7258F08D880B217BADEF41B29F25416AE3058B791D370DC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135C450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 83680dd5cad6d55fafd77d6f1de7c18347dea72b974fbb382b773fb3bc435be9
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 34019671140606BFE726AF69CC90E62FBBDFF5475CF004525F614525A0C722ACA1C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01394015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e05585023f259d9d185ed4a889202c920a052c07325deac2248f17fc6cc17f3
Instruction ID: b2edef5342c7ec54f32cb2751ee0dac0267e7b1aa1ce08beea929022f61f4817
Opcode Fuzzy Hash: 1e05585023f259d9d185ed4a889202c920a052c07325deac2248f17fc6cc17f3
Instruction Fuzzy Hash: 5601F272251946BFC715AB79CE84E63F7ECFF59664B000229F60887A11DB34EC12C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0138138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c600bb9314d74ea712946650ee9dd3577479bcbddb1a89b0ffd7871195f72e
Instruction ID: 21a15b58ec9316deaad81fb380e53c95648e267226f0d7e435158d7b8fce8bf7
Opcode Fuzzy Hash: 38c600bb9314d74ea712946650ee9dd3577479bcbddb1a89b0ffd7871195f72e
Instruction Fuzzy Hash: 50019271A0030CAFDB10EFA8D841FAEBBF8EF44714F004066B904EB680D6709A41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013814FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736a3f387f139a6e86e67445ddd5a5be736e1edb5773144b2e9705210062e2d1
Instruction ID: 46ae133aafad3f39343ff2e5ace901889ef7775265c58ebce748f4125970c9a7
Opcode Fuzzy Hash: 736a3f387f139a6e86e67445ddd5a5be736e1edb5773144b2e9705210062e2d1
Instruction Fuzzy Hash: FF018C71A0124CAFDB10EFA8D845EAEBBB8EF44714F404066B904EB280DA70DA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012C58EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740928b1ef708e69add7b417a1fb864c5a8f35ed550e233896df95e21e15a389
Instruction ID: 1e33279a4a6f05f92f11aa20b200c95db6b0302c82a25784a36a2940d06fe58b
Opcode Fuzzy Hash: 740928b1ef708e69add7b417a1fb864c5a8f35ed550e233896df95e21e15a389
Instruction Fuzzy Hash: 4001DF31B201099BC714EE28DC01AEE77ACEB51624F8402ADAB0997244EF30ED05C790

Uniqueness

Uniqueness Score: -1.00%

Function 012DB02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: a73dbf0cb875d4c7fca7e731f774ee8b7253b532e8334ad503c79857733c615f
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 3B018F32221985DFE322971CC998F767BDCEB86B54F0A00A1FA19CBA51D769DC40C620

Uniqueness

Uniqueness Score: -1.00%

Function 01391074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bed007b40f887e21d0c07aa394d0f1d5bb4a42f0f6cb03b849de4e559a67d1
Instruction ID: 09d81a954df84b6cf98d8d20522c05de0fec8136db755c3f9411ab8a80058b75
Opcode Fuzzy Hash: 41bed007b40f887e21d0c07aa394d0f1d5bb4a42f0f6cb03b849de4e559a67d1
Instruction Fuzzy Hash: A9014C726047479FCB20EF2CC944B1A7BD9BF84328F048519F98593790EE31D444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0137FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7692f1cc8820ccd462c45bba104cb1ebf99b10e5efbde3488412264c2c9cc4e1
Instruction ID: 0e2c0b950266c6710e48313111e9cdcab9c6b21b9c3768ac8982d437e9c48b85
Opcode Fuzzy Hash: 7692f1cc8820ccd462c45bba104cb1ebf99b10e5efbde3488412264c2c9cc4e1
Instruction Fuzzy Hash: 4201D471E0020DAFDB24DFA8D845FAEBBFCEF40704F004066B904AB281DA749900C795

Uniqueness

Uniqueness Score: -1.00%

Function 0137FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cb953970ab0c8b0abd0c986c28d9a6913c18edce753894ff39387850637871
Instruction ID: d2a922be3ac3a8f00b39da082bed76b326a6acd6dd988b2854a278b097571969
Opcode Fuzzy Hash: f8cb953970ab0c8b0abd0c986c28d9a6913c18edce753894ff39387850637871
Instruction Fuzzy Hash: 35018471E0120DAFDB14EBA9D845FAEBBBCEF44714F404066BA04AB281EA749A41C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 01398A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf39845fef08bf31d707c7ccc1564650bfa5635b98181df9522f80c8cd2aab3a
Instruction ID: b7b82bff5becea5d3b93b9b5a400aec82f0222b6714dad9ed962c3bd8d8afb37
Opcode Fuzzy Hash: bf39845fef08bf31d707c7ccc1564650bfa5635b98181df9522f80c8cd2aab3a
Instruction Fuzzy Hash: 7D012C71A1121DAFDB00DFA9D941AAEBBF8EF59314F10405AFA04E7381E734A900CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01398ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98059307ca46ef2f895c79a8212e2f32e2729b5d03461822d05652e01c21c1a7
Instruction ID: b879142c0ab62f1a56b33a2d7c223b6c2c3a7fd144a86db89b63cb38a316e8a2
Opcode Fuzzy Hash: 98059307ca46ef2f895c79a8212e2f32e2729b5d03461822d05652e01c21c1a7
Instruction Fuzzy Hash: 5E111E70E042099FDB04DFA8D445BAEFBF4FF08304F0442AAE519EB782E6349940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012CDB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 305c8e0c41c8dcd45664227bcf5d767fe6f03c052e00ddb5f8a1664adc55f304
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 0BF09C332715279BD7326AD9C8C4F77BAA59FD1E60F16023DF3099B344D9608C0296D5

Uniqueness

Uniqueness Score: -1.00%

Function 012CB1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 6ffefba5158da27e64f022c01fcb0d4427e3bf90aa824a20043fef7b0ef9b378
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 8101F432220684DBE322A75DD809F697FD9EF91B98F0800A5FB148B6B2D779C800C355

Uniqueness

Uniqueness Score: -1.00%

Function 0135FE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fe9eb0708b87df219ece1d99559d050b6eab07ec03ddd13b13939b36d1dfa0
Instruction ID: eb5772c1ae8b1c114b6042f8b723cb36d1e5658c8fe7bf1ea9c48e64318601b1
Opcode Fuzzy Hash: 20fe9eb0708b87df219ece1d99559d050b6eab07ec03ddd13b13939b36d1dfa0
Instruction Fuzzy Hash: A5018670A0020DEFCB54DFA8D546A6EB7F4FF04704F144169B908DB382D635D901CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0138131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ab0cbdbc373f1e42e28a0da94d2351ca656cb6fb00d4f73f3a94982e3170c1
Instruction ID: 7b2abf955fe60b2510c4f9fceb81144f380e86187746f00e782ea245c9be60b5
Opcode Fuzzy Hash: 46ab0cbdbc373f1e42e28a0da94d2351ca656cb6fb00d4f73f3a94982e3170c1
Instruction Fuzzy Hash: 62013C71A0120DAFCB44EFA9D545AAEB7F4FF18704F404069B905EB381E6749A00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01398F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1395ecab497361d85cd84c06ec42048a03f4ae0acaca0f826762a4598d56d7
Instruction ID: 90dabb2de9a473979faedf53777beab70c5f90ed4427597c04d14563c2287da6
Opcode Fuzzy Hash: 7f1395ecab497361d85cd84c06ec42048a03f4ae0acaca0f826762a4598d56d7
Instruction Fuzzy Hash: EE014475A0120DAFDB00DFACD545AAEB7F4EF58304F504059B909EB381EB74DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01381608, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a2cad02226b192f081e98d854c73b5ccc76df7a5c3b4d3a70c725816710b2c
Instruction ID: 20ac41d5432aa86e022bd587326ca24d17318e23168ad54820e73828a30261a1
Opcode Fuzzy Hash: c9a2cad02226b192f081e98d854c73b5ccc76df7a5c3b4d3a70c725816710b2c
Instruction Fuzzy Hash: 04F06271E0524CEFDB14EFA8D445A6EB7F8EF14304F444069A905EB381E6349A00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012EC577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688b3e38b557198292dc1290470a9577f91fe8179c8528b0aa9d6ea52d194edc
Instruction ID: 43e0bd2aa0a40294c2734c439634058fcf443044b60ca9ea531eef687b6fa067
Opcode Fuzzy Hash: 688b3e38b557198292dc1290470a9577f91fe8179c8528b0aa9d6ea52d194edc
Instruction Fuzzy Hash: ADF0BEF29356969FE736C7ECE01CF627FE89B05670FD484A7D616A7202C6A4D8A0C250

Uniqueness

Uniqueness Score: -1.00%

Function 01382073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af1432679986e589a1403dcd3868f0f9300ff9d952528bf1fa98c9b69fa8262
Instruction ID: 153c412f678e7cf5943d7f82d15e349b62b565ce5010429c0b5dd05ffd1d537a
Opcode Fuzzy Hash: 2af1432679986e589a1403dcd3868f0f9300ff9d952528bf1fa98c9b69fa8262
Instruction Fuzzy Hash: 85F0A0BA8152858AEE33BF2C79522E33F9ED79621CF1A14C5D6A057209D5388893CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0130927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: d57fe5e2461f6aafedfbe677edd004fb883e58ff32343e92d5662dfa3f2b0a44
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: B1E02B723405416BE7229E09CC94F1337DDDF92728F004078B9045E283C6E6DC0887A0

Uniqueness

Uniqueness Score: -1.00%

Function 01398D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ea03262e020c5eea5654366592a76b31567ca9532549b1bd0ff7c734b46e16
Instruction ID: 58570eb57e4f3c9cd0e3bb73e6430fa9dd7734863f7b22195d5ee765e210f635
Opcode Fuzzy Hash: 56ea03262e020c5eea5654366592a76b31567ca9532549b1bd0ff7c734b46e16
Instruction Fuzzy Hash: 42F05E70E0460DAFDB14EFB8D555B6EB7F8EF58704F5080A9EA05EB291EA34D900CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01398B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e1bc8f20017150eb2534a511ead5c0828f2faee06c00c5269ff8e220d168c2
Instruction ID: fcb7e9211e0a6dba5967a0d832b01b6db6f7418ead213600afd553dabb8b9e74
Opcode Fuzzy Hash: f0e1bc8f20017150eb2534a511ead5c0828f2faee06c00c5269ff8e220d168c2
Instruction Fuzzy Hash: A7F05EB1A1425DABDB10EBA8D916A6EB7A8AB44308F440499AA059B2C1EA74D900C794

Uniqueness

Uniqueness Score: -1.00%

Function 012E746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a131f362a80dd10751540454252b0ceb1b9f2c53d14ee1d7178d12c1180589d
Instruction ID: 0452ec3cd51474cd3f52a07dd5b8174df28d97195160be1527adce7a729c347f
Opcode Fuzzy Hash: 4a131f362a80dd10751540454252b0ceb1b9f2c53d14ee1d7178d12c1180589d
Instruction Fuzzy Hash: F1F0E234A3024AEADF12EB6CC845F79BFF5EF14218F840215EA91AB1A1E775D800C7C5

Uniqueness

Uniqueness Score: -1.00%

Function 01398CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb90f113d691a18177a862b33cd34fc687e9d73edf543357f88b42ea2a6d2792
Instruction ID: 37629721e2b6cfbf68559fbe616d641e63d257bab2f170f4198649f7c360990e
Opcode Fuzzy Hash: eb90f113d691a18177a862b33cd34fc687e9d73edf543357f88b42ea2a6d2792
Instruction Fuzzy Hash: 05F08270A0520DAFDF04DBA8E955E6E77F8EF59308F500199E915EB2C1EA34D900C754

Uniqueness

Uniqueness Score: -1.00%

Function 012C4F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dd21cee23c1f68a4e58b6abaeb12fbf6df2f71894e69f0c06487945bf19292
Instruction ID: c3d0cf1a2891461ca166b054c1f5cf32b9b924227f8ca65f2554d2952acbf2b5
Opcode Fuzzy Hash: 09dd21cee23c1f68a4e58b6abaeb12fbf6df2f71894e69f0c06487945bf19292
Instruction Fuzzy Hash: 13F0E2325256A98FD776EB1CD184B22BBD5AB0177CF4444A4E40587922C724EC48C680

Uniqueness

Uniqueness Score: -1.00%

Function 012FA44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef05ec457eadb5a9dacca8a4ed15e11a614a3d6b6d3a0bd502c2be01b995171
Instruction ID: 23d8e1e9747d20d258658c79b6233da400204650304e46fe94d7f041aba97c4d
Opcode Fuzzy Hash: 0ef05ec457eadb5a9dacca8a4ed15e11a614a3d6b6d3a0bd502c2be01b995171
Instruction Fuzzy Hash: 1CE09272A11422ABD2229A18AC00F66B39DEBE4651F094039EB08C7254D668DD01CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 012CF358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 2ddbb860268ec0e05f32d2eb46025c3295e4db7b1473dfd1366a6e186cf3e647
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: CFE0D833A50158FBDB21A7D99E05FAABFADDB54E60F00015ABF04DB190D5609D00C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 012DFF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0416e2594170a51d3927ad040bd47611a7c82a69c4215aebc215b09134698855
Instruction ID: 47059df9f148fd00e06d4571f8ec2ae3f5608087cb0db8d6ceebb16f5543b13e
Opcode Fuzzy Hash: 0416e2594170a51d3927ad040bd47611a7c82a69c4215aebc215b09134698855
Instruction Fuzzy Hash: ABE0DFB02292069FDB35DB59D240F2D3B989B52729F19809DE90A4B182C621E882C29E

Uniqueness

Uniqueness Score: -1.00%

Function 013541E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc5439ef33ac7ca7046ed46fd2f307ce05e6f989f8a387a8c0f6fdf79ef4b8a
Instruction ID: 44fdd5b5933ffaaadb917a2359bec77e43fd78b0f4b9ff637414801d70fe8b35
Opcode Fuzzy Hash: 8dc5439ef33ac7ca7046ed46fd2f307ce05e6f989f8a387a8c0f6fdf79ef4b8a
Instruction Fuzzy Hash: F0F01578820709CECBB4EFA9E58AB2436ACFB5476EF10419A920087688F73444A5CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0137D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 547d157db2c7bf989d5fbdf90bfea1d904a847171d3bdf42bc6f2ca6b0969c10
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: E5E0C231280209BBEB325E84CC00F797B5ADF50BA4F104035FE085AAA0C6799C91DAC4

Uniqueness

Uniqueness Score: -1.00%

Function 012FA185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66fdeaa55dbd7f2a26a20b8a1c1293e5a2d0d88fedd8c8d39e65293b15362df3
Instruction ID: bb6611b749807794d3fbed2cb15e3fc623c467ed3c7d0e981fd38fb4675b9952
Opcode Fuzzy Hash: 66fdeaa55dbd7f2a26a20b8a1c1293e5a2d0d88fedd8c8d39e65293b15362df3
Instruction Fuzzy Hash: B0D02BE117100016D62D130098AAB76365EF794754F35041CF30B4BD92F9508CD88118

Uniqueness

Uniqueness Score: -1.00%

Function 012F16E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32edc6a781c05cce2960a4178e0e4eef7b85ccf4708db712b5aacedd8fbbc404
Instruction ID: e3b800a106db2546de602f8784c0e00ca59e366d72ff63d5351d494200ebf2c1
Opcode Fuzzy Hash: 32edc6a781c05cce2960a4178e0e4eef7b85ccf4708db712b5aacedd8fbbc404
Instruction Fuzzy Hash: ABD0A771120142DAEE2D5B149845B246655EB90785F78007CF30B598C1EFA1DCB2E44C

Uniqueness

Uniqueness Score: -1.00%

Function 013453CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 9d0ace69c7427e3d5e507c4bb844c1e240345a23e0c39d56dcf035d0c8e359b6
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 5EE08C329507809BCF16EB49C650F5EBBF5FB44B00F150044A0085F620C624AC00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 012DAAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 5b99b5335035badbbd1c91bfd57479bcbb833ac54e7e18a60a371fea36dbfc88
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: CBD0E939352991CFD617DB1DC554B1577B4BB44B44FD50590E501CBB62E62CD944CA00

Uniqueness

Uniqueness Score: -1.00%

Function 012F35A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: ec7aa5a2bf8d403c3c5facbd2d3bd7911160f564557e015ec8094069a5746a44
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 48D0A77143118299DF01EB14E11C7FCB771BB44308F58107D834109452C3354909C700

Uniqueness

Uniqueness Score: -1.00%

Function 012CDB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 95e828255a598526802eee51770d6c9c2e23a59ffb5902e4d2c1c64589e12344
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 74C08C302A0A42AEEB222F20CD01B103AA0BB10F01F8400A06700DA0F0EB78D801EA00

Uniqueness

Uniqueness Score: -1.00%

Function 0134A537, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: f75e952279074d14de345b12572e83f9afd1430fe2727e82b2c9dc165f7c6ac8
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 55C08C33080248BBCB126F81CC00F267F6AFBA4B60F048010FA480B570C632E970EB94

Uniqueness

Uniqueness Score: -1.00%

Function 012E3A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: a23b48ed9b8bd8d286760d11c143447df584b60ed5f87a2a260f07fa1ed5fd32
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: B0C08C32080288BBCB126E41DC00F117B69E7A0B60F000020BA080A5608532EC60D98C

Uniqueness

Uniqueness Score: -1.00%

Function 012CAD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 5af7c26f40d60857d88766a2b22142e985b3434ca076347fb2104e5459abf6ed
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 34C02B330C0248BBC7166F46DD00F117F6DE7A0B60F000020F6040B671C932EC60D5C8

Uniqueness

Uniqueness Score: -1.00%

Function 012D76E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 6b613d982ab21ba9e1804cc76b8fe2ac2a89bed6c00a5b2e7bf224b67277be2d
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: A3C08C701A11825EEB2E570CCE24B307A90AB0860CF88019CAB01094E2D36CA802C288

Uniqueness

Uniqueness Score: -1.00%

Function 012F36CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 0d8fc6b5744271ee3b470349d7c08a4516109c81588a938d94cd7c0c945f82b0
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 0DC02B70170480FFDB156F30CD00F24B2D4F700A21FA403687320854F0D528DC00D50C

Uniqueness

Uniqueness Score: -1.00%

Function 012E7D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: c38cd9e402216bfc490b473bd3cdb6c37e96630d498e2907ce44739c0ca6f1c4
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: FFB09235311942CFCE16DF18C084B1533E8BB44A40F8400D0E400CBA21D32AE8008900

Uniqueness

Uniqueness Score: -1.00%

Function 012F2ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 5a0124c324424514ba7891299b668fb3b8c527669462d7ec0f4df916990edb2c
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: B5B01232C20541CFCF02FF40C610B297331FB00750F06449090012B930C228BC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01309950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee667bba821a137e044d059010fdf955fb60f82a330f7f12f15ca5a0b3e20f7
Instruction ID: 7c3af462cf6d045dc2e6e3775a19200237cb0d1c8996e5dfe1dad5e2cbc58738
Opcode Fuzzy Hash: dee667bba821a137e044d059010fdf955fb60f82a330f7f12f15ca5a0b3e20f7
Instruction Fuzzy Hash: 799002A520141403D544659948086070405A7D1346F51C421A2054555ECA698C657175

Uniqueness

Uniqueness Score: -1.00%

Function 013099D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f35747f847b3e77a9c9bd355bc687029de3d5aa6c19350df66b75539c03045
Instruction ID: dc65bbfc53d3a22b3b18fb6f48d7f1720abec74e082aacd7a40f306698b19c5f
Opcode Fuzzy Hash: 01f35747f847b3e77a9c9bd355bc687029de3d5aa6c19350df66b75539c03045
Instruction Fuzzy Hash: B19002A521101042D508619944087060445A7E2345F51C422A2144554CC5698C756165

Uniqueness

Uniqueness Score: -1.00%

Function 01309820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e88820a7e99ef475c6d014ebdb6e2aef1d0e66535682ef93ab86f75e70b476
Instruction ID: a8e8f4231b41dfc3032920b8f1b7ae52afcc2fcd138785d4918543d3cf31f220
Opcode Fuzzy Hash: b0e88820a7e99ef475c6d014ebdb6e2aef1d0e66535682ef93ab86f75e70b476
Instruction Fuzzy Hash: F590027524101402D545719944086060409B7D1385F91C422A0414554EC6958A6ABAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d52e281404eec23fa97d29f8d51074f1f5aa0572b36beb09b9ef5cec2e65e4
Instruction ID: 7dbf43c3fe44aece7c548a3e0586d462efd79169df008138055ea6cd102e7291
Opcode Fuzzy Hash: d2d52e281404eec23fa97d29f8d51074f1f5aa0572b36beb09b9ef5cec2e65e4
Instruction Fuzzy Hash: EC9002A5601150438944B19948084065415B7E2345391C531A0444560CC6A88869A2A5

Uniqueness

Uniqueness Score: -1.00%

Function 013098A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b377f492f3885cb10921b5c2aa608edf0744f0e97e0e0f1ab23e5d1b9e0e63d8
Instruction ID: 08bb7e90d150d3b1be341968f75cddc306ac77f225857ce35c07475ab870cd8a
Opcode Fuzzy Hash: b377f492f3885cb10921b5c2aa608edf0744f0e97e0e0f1ab23e5d1b9e0e63d8
Instruction Fuzzy Hash: 7E90026530101402D506619944186060409E7D2389F91C422E1414555DC6658967B172

Uniqueness

Uniqueness Score: -1.00%

Function 01309B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f2634648613efb6768e2d4380e969f7aa96ae827393cca44ce5c6d2e236b48
Instruction ID: 7fb035a1a2413589fcccf666919fdeb1852a3ab476d5a905332ace62d2a47ca4
Opcode Fuzzy Hash: 63f2634648613efb6768e2d4380e969f7aa96ae827393cca44ce5c6d2e236b48
Instruction Fuzzy Hash: C690026524101802D544719984187070406E7D1745F51C421A0014554DC656897976F1

Uniqueness

Uniqueness Score: -1.00%

Function 0130A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfd6d94182ab58a221d9e58cd823d9ce13e3173701ad59e83cbfbbe785ad006
Instruction ID: b65f4f09cf0bc54eb742201c51806bf76b6a6893d75c4f04129cff69e6425ea5
Opcode Fuzzy Hash: ecfd6d94182ab58a221d9e58cd823d9ce13e3173701ad59e83cbfbbe785ad006
Instruction Fuzzy Hash: AF90027520145002D5447199844860B5405B7E1345F51C821E0415554CC655886AA261

Uniqueness

Uniqueness Score: -1.00%

Function 01309A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1747afce598d4b12a17829c05f050401cfb383a81ec542b9261728ecba1340
Instruction ID: 0f1d43bf42128bd450ba022355354ed7b162f904d1bf09fe1165fa0251d386e7
Opcode Fuzzy Hash: 1f1747afce598d4b12a17829c05f050401cfb383a81ec542b9261728ecba1340
Instruction Fuzzy Hash: 5C90027520141402D5046199480C7470405A7D1346F51C421A5154555EC6A5C8A57571

Uniqueness

Uniqueness Score: -1.00%

Function 01309A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771361274485398706d8b36495c4ea77f43f3424f250f326b715e9a7102d2018
Instruction ID: f1f06c079a0b3bcb653bd5d0c3e8bed54e525df85bbaf85b178badf8f10f9e36
Opcode Fuzzy Hash: 771361274485398706d8b36495c4ea77f43f3424f250f326b715e9a7102d2018
Instruction Fuzzy Hash: CF90026520145442D54462994808B0F4505A7E2346F91C429A4146554CC95588696761

Uniqueness

Uniqueness Score: -1.00%

Function 0130AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ed6859ba467e031def712ba9a40d312bf121e709d6373f788d62fb12c40c98
Instruction ID: 38871af5a5ff3edeedec447352c0f7be3015841bac2a5d2d2ed9a0947d7ead86
Opcode Fuzzy Hash: 76ed6859ba467e031def712ba9a40d312bf121e709d6373f788d62fb12c40c98
Instruction Fuzzy Hash: 19900275A0501012D544719948186464406B7E1785B55C421A0504554CC9948A6963E1

Uniqueness

Uniqueness Score: -1.00%

Function 01309520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041a74bb9725fa68463bd974c8f8075486d1daca04967e775bd98a6870f3fb88
Instruction ID: d2a7da4f0e25f8e6247e693ae4976febcc64162cd08a62f81b13d1ffc12ac4a6
Opcode Fuzzy Hash: 041a74bb9725fa68463bd974c8f8075486d1daca04967e775bd98a6870f3fb88
Instruction Fuzzy Hash: C99002E5201150928904A2998408B0A4905A7E1345B51C426E1044560CC5658865A175

Uniqueness

Uniqueness Score: -1.00%

Function 01309560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7848ab64cccbdf27e23f3ea87921e1f5fb345b9843ac0c1fc1a82ac6269c5b3b
Instruction ID: da6ed29b4223349bff35b767ef14884f9474656191183c570d687b691d89413e
Opcode Fuzzy Hash: 7848ab64cccbdf27e23f3ea87921e1f5fb345b9843ac0c1fc1a82ac6269c5b3b
Instruction Fuzzy Hash: 8F900269221010024549A599060850B0845B7D7395391C425F1406590CC66188796361

Uniqueness

Uniqueness Score: -1.00%

Function 013095F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aef16063e3311bed51db346036eb64993a8046c58dc727dd3f97606c7847f48
Instruction ID: 146127ba377e78c1f843af9ea0294e58e951a8916b72f80e73eae57fa0e9e84c
Opcode Fuzzy Hash: 0aef16063e3311bed51db346036eb64993a8046c58dc727dd3f97606c7847f48
Instruction Fuzzy Hash: C190027520101802D508619948086860405A7D1345F51C421A6014655ED6A588A57171

Uniqueness

Uniqueness Score: -1.00%

Function 01309730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa93beb461dcc36b4a6734e3383bd8ad22db6950b5a8306b48c92f3c90151d8
Instruction ID: 6f7cb8363dfbc835e7de91e329fe6d0b63c4bb255b581851ea8097c01fad49af
Opcode Fuzzy Hash: 6aa93beb461dcc36b4a6734e3383bd8ad22db6950b5a8306b48c92f3c90151d8
Instruction Fuzzy Hash: A490026560501402D5447199541C7060415A7D1345F51D421A0014554DC6998A6976E1

Uniqueness

Uniqueness Score: -1.00%

Function 0130A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb357f9efc631dd084d09c5fb39ef156e59b912fcd061660394725fd96e1849
Instruction ID: 827719fb7ab7b37785cfe0217a096f39e3fbd1101dd3c4904e9af1720ab9832d
Opcode Fuzzy Hash: fdb357f9efc631dd084d09c5fb39ef156e59b912fcd061660394725fd96e1849
Instruction Fuzzy Hash: 1790027530101052D904A6D95808A4A4505A7F1345B51D425A4004554CC59488756161

Uniqueness

Uniqueness Score: -1.00%

Function 0130A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eddc2db431eec1d7a53e63c336010d96382ca14a437e010e583ade461f0c284
Instruction ID: 6f04dbd8d1be34cdaf45c122b8aa65b5e90f56b2459fb91ce69a8737658810e5
Opcode Fuzzy Hash: 7eddc2db431eec1d7a53e63c336010d96382ca14a437e010e583ade461f0c284
Instruction Fuzzy Hash: BF90027920505442D90465995808A870405A7D1349F51D821A041459CDC6948875B161

Uniqueness

Uniqueness Score: -1.00%

Function 01309770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06f21a788ac7c6b28dc3ba99c0fe883f804ab7b777afd12d33980c6f1cd823b
Instruction ID: 67adb8f486773aae831ebbeb60f3c84e7cc41c6a9eada2695a2096a02155d099
Opcode Fuzzy Hash: a06f21a788ac7c6b28dc3ba99c0fe883f804ab7b777afd12d33980c6f1cd823b
Instruction Fuzzy Hash: 7590026520505442D5046599540CA060405A7D1349F51D421A1054595DC6758865B171

Uniqueness

Uniqueness Score: -1.00%

Function 01309760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a7b3e9d66a96f08fd1985963110b46d63407f561c5499d771308552b31a5d2
Instruction ID: ede2742b648f95dd26fadc47fe9014ff810222e6447faedf6a200a611d8c5a42
Opcode Fuzzy Hash: 22a7b3e9d66a96f08fd1985963110b46d63407f561c5499d771308552b31a5d2
Instruction Fuzzy Hash: F290027520101403D5046199550C7070405A7D1345F51D821A0414558DD69688657161

Uniqueness

Uniqueness Score: -1.00%

Function 01309610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba63956297cc33e8fb050e3a5bf778a8bf57a256403407f96a1ef3b390f8ae73
Instruction ID: 5d3c4b87ee0630ea9bcee067b21fab7248fe4495c1f18760ff988f1af96cb04a
Opcode Fuzzy Hash: ba63956297cc33e8fb050e3a5bf778a8bf57a256403407f96a1ef3b390f8ae73
Instruction Fuzzy Hash: 3E90027560501802D554719944187460405A7D1345F51C421A0014654DC7958A6976E1

Uniqueness

Uniqueness Score: -1.00%

Function 01309650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43554a7e5f1679e84eb1e98aee6a367235a097019403033412e100d9e33f996
Instruction ID: 32e9587b7d161dc1c813073c8676a08cd8eef4222e4a03811026c536119a7af5
Opcode Fuzzy Hash: a43554a7e5f1679e84eb1e98aee6a367235a097019403033412e100d9e33f996
Instruction Fuzzy Hash: E190027520505842D54471994408A460415A7D1349F51C421A0054694DD6658D69B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 013096D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd1a59a4be5bbeca61b1472b4d0f0f8c652fff35494a9ef430d7d1a11df459c
Instruction ID: 3a8e3832a441e5dbedf0deabf6be17cc86013848f09f7ea4caaab01f13e0685c
Opcode Fuzzy Hash: 1bd1a59a4be5bbeca61b1472b4d0f0f8c652fff35494a9ef430d7d1a11df459c
Instruction Fuzzy Hash: AE90027520101842D50461994408B460405A7E1345F51C426A0114654DC655C8657561

Uniqueness

Uniqueness Score: -1.00%

Function 01309670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 04ecf686a11e89cb9957f9afea7c912be5bf82e231fb4e0740bcdab2a700d994
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0135FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0135FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0130CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01355720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01355720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0135fdda
0x0135fde2
0x0135fde5
0x0135fdec
0x0135fdfa
0x0135fdff
0x0135fe0a
0x0135fe0f
0x0135fe17
0x0135fe1e
0x0135fe19
0x0135fe19
0x0135fe19
0x0135fe20
0x0135fe21
0x0135fe22
0x0135fe25
0x0135fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0135FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0135FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0135FE2B

Memory Dump Source

Source File: 0000000D.00000002.393048414.00000000012A0000.00000040.00000001.sdmp, Offset: 012A0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: ed9f3c480f6fb73e1577791c59af5fcc4fe7405d7689e77a623c60d9357cb04e
Instruction ID: 68ffe4a54bcb3d0377e39107f23522caa546c49ee3498720b2b8fde0bd33a360
Opcode Fuzzy Hash: ed9f3c480f6fb73e1577791c59af5fcc4fe7405d7689e77a623c60d9357cb04e
Instruction Fuzzy Hash: 82F0F632200201BFE7611A49DC02F63BF5EEB44B74F240314FA28565D1EA62F86097F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cmmon32.exe PID: 4772 Parent PID: 576 cmmon32.exeCOMMON

Executed Functions

Function 032881B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,03283B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,03283B87,007A002E,00000000,00000060,00000000,00000000), ref: 032881FD

Strings

.z`, xrefs: 032881ED, 032881F8

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 6083bca3a3d3672e32c92597c38868223b620ce8625c24c50ff031df9db506d6
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 8BF0B2B2211208ABCB08DF88DC84EEB77ADAF8C754F158248BA0D97240C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 032881AA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,03283B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,03283B87,007A002E,00000000,00000060,00000000,00000000), ref: 032881FD

Strings

.z`, xrefs: 032881ED, 032881F8

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: d5ab14c4ad75129ae44f11daaefdbbf82298f557f787b086f0e786d0f5d8979b
Instruction ID: 2e691a94a014082e9fdf81366698bc4dcf87bef7963040a7d14ed4a1ee408a64
Opcode Fuzzy Hash: d5ab14c4ad75129ae44f11daaefdbbf82298f557f787b086f0e786d0f5d8979b
Instruction Fuzzy Hash: 7CF0ACB2214409AF8B04DF8CDD80DEB73EEEF8C754B458249FA1DD3240D630E8618BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03288260, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(03283D42,5E972F59,FFFFFFFF,03283A01,?,?,03283D42,?,03283A01,FFFFFFFF,5E972F59,03283D42,?,00000000), ref: 032882A5

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: f2780110bb3598494cee3e06f6f261c33d69c43176181f9a83e1db5b40ded32a
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 96F0A9B6210208ABCB14DF99DC80DEB77ADAF8C754F158248BA1D97241D630E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 032882DA, Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(03283D20,?,?,03283D20,00000000,FFFFFFFF), ref: 03288305

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ef4dd95fd9b4f882ecc57c394c81a676cd5e551e016acccdd26bca5128f1c604
Instruction ID: 69648dbf719770378ee884c30a607e972cb181a89a13a97e209dff3b6f870528
Opcode Fuzzy Hash: ef4dd95fd9b4f882ecc57c394c81a676cd5e551e016acccdd26bca5128f1c604
Instruction Fuzzy Hash: 36F05E76200214AFDB10EF98EC80EEB77ADEF88350F148559FA0C9B241C630FA118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03288390, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,03272D11,00002000,00003000,00000004), ref: 032883C9

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 462ef9d55b86943e098501dcaa5ce08e82c32a6fcbfac4c0c27c49e6a6db9304
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 83F015B6210208ABCB14DF89CC80EEB77ADAF88754F118148BE08A7241C630F810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 032882E0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(03283D20,?,?,03283D20,00000000,FFFFFFFF), ref: 03288305

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: b1df54e145324d1c6436e48bbdd55a154bff98000569a5b3cee732d57b30103d
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 03D012762003146BD710EF98CC45ED7775CEF44750F154455BA185B241C570F90086E0

Uniqueness

Uniqueness Score: -1.00%

Function 05239910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523991A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6974cbcd428f21f19a2b51a421a13b2866f4073f27d3bdbd3c8c202beaeaf3b1
Instruction ID: 455214704ea16b86f20f446639bd384290e1551ab74d4bb13f01b171dca8a05e
Opcode Fuzzy Hash: 6974cbcd428f21f19a2b51a421a13b2866f4073f27d3bdbd3c8c202beaeaf3b1
Instruction Fuzzy Hash: DD9002B231100402D1447169844474600159BD0341F91C011A5054594E86D98DD57AA5

Uniqueness

Uniqueness Score: -1.00%

Function 05239540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523954A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5bb73407742cec637d9684202242200fdca49d6e7096ac0839a5661be40917eb
Instruction ID: f51ed39d489cf303713701f9b118d72e7ae2d4bde8c62e7386ecb08ac7d499f1
Opcode Fuzzy Hash: 5bb73407742cec637d9684202242200fdca49d6e7096ac0839a5661be40917eb
Instruction Fuzzy Hash: 0B900266321000030109A569474450700569BD5391391C021F1005590CD6A188616561

Uniqueness

Uniqueness Score: -1.00%

Function 052399A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 052399AA

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d37275da9cbd4781d0951e7d732e6f5eea38bac9feb29b6118b84c21879910c4
Instruction ID: a215c82f30e4663f3926cd8e19cea6205bbaaa2f9ed6382e5a397f34d2781a0f
Opcode Fuzzy Hash: d37275da9cbd4781d0951e7d732e6f5eea38bac9feb29b6118b84c21879910c4
Instruction Fuzzy Hash: 2D9002A235100442D10461698454B060015DBE1341F91C015E1054594D8699CC527566

Uniqueness

Uniqueness Score: -1.00%

Function 052395D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 052395DA

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6dcfb58af0eb9045f720b04f8cef19012e5b6a4f5a4a489d4e8f173f73f67ca9
Instruction ID: 9b253ac2d9a002e6e6422f256bc486388aa1e8db20952512c3a05acadda071b9
Opcode Fuzzy Hash: 6dcfb58af0eb9045f720b04f8cef19012e5b6a4f5a4a489d4e8f173f73f67ca9
Instruction Fuzzy Hash: 889002A231200003410971698454616401A9BE0241B91C021E10045D0DC5A588917565

Uniqueness

Uniqueness Score: -1.00%

Function 05239860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523986A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ea448ed548e3d45a52de299912024ed62897215b22b71a73c731dc167e23bd2
Instruction ID: 2df8d188f1df003302384b000a65188d2ef5e2afb0f6f02c40e57921b909eece
Opcode Fuzzy Hash: 9ea448ed548e3d45a52de299912024ed62897215b22b71a73c731dc167e23bd2
Instruction Fuzzy Hash: C690027231100413D1156169854470700199BD0281FD1C412A0414598D96D68952B561

Uniqueness

Uniqueness Score: -1.00%

Function 05239840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523984A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bb4eb2ce0a8e120c45f37505c89fc750f0588a98ccedb0dde0d5bc3fcab07582
Instruction ID: bc0ea5b631b09ab4fac2853bc63ba699e49817592af61c2b36ff76549b638520
Opcode Fuzzy Hash: bb4eb2ce0a8e120c45f37505c89fc750f0588a98ccedb0dde0d5bc3fcab07582
Instruction Fuzzy Hash: 42900262352041525549B16984445074016ABE02817D1C012A1404990C85A69856EA61

Uniqueness

Uniqueness Score: -1.00%

Function 05239710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523971A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8e966d74a62460e3108b90471422fddd6834c10a3ecef4e68d5c4ce99365dce6
Instruction ID: 42a55e7a7fea8eb9301a344275913bd2a6e446cb209c3d3ab227d4399b54b270
Opcode Fuzzy Hash: 8e966d74a62460e3108b90471422fddd6834c10a3ecef4e68d5c4ce99365dce6
Instruction Fuzzy Hash: 5A90027231100402D10465A9944864600159BE0341F91D011A5014595EC6E588917571

Uniqueness

Uniqueness Score: -1.00%

Function 05239780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523978A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7bcf840255633d03fd54365662cf1f1f791019ea6660a2036dec24eb8f70f803
Instruction ID: 54899997d38e7bd9b458121bbc281034132d79bfc20bd5d687169b255016aa21
Opcode Fuzzy Hash: 7bcf840255633d03fd54365662cf1f1f791019ea6660a2036dec24eb8f70f803
Instruction Fuzzy Hash: 3490026A32300002D1847169944860A00159BD1242FD1D415A0005598CC99588696761

Uniqueness

Uniqueness Score: -1.00%

Function 05239FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05239FEA

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00b78ba8747f484997bea6efdbf08486ffb1e1a00635e8097c443cb19133e682
Instruction ID: e4e209f045a5b0cacb47183bf160c26d76e17c148d19ba3bb0f86dbf2bf74685
Opcode Fuzzy Hash: 00b78ba8747f484997bea6efdbf08486ffb1e1a00635e8097c443cb19133e682
Instruction Fuzzy Hash: FF90027232114402D1146169C44470600159BD1241F91C411A0814598D86D588917562

Uniqueness

Uniqueness Score: -1.00%

Function 05239660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523966A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0a002dcdd45d1c7ea8dfe1f39c430889efa70bf23ec22e3dbf6a5b0c1a60150c
Instruction ID: 8a4540b6a00be58f91fc9833c74dad2155680c04ca18d5105ec207af2711a672
Opcode Fuzzy Hash: 0a002dcdd45d1c7ea8dfe1f39c430889efa70bf23ec22e3dbf6a5b0c1a60150c
Instruction Fuzzy Hash: F490027231100802D1847169844464A00159BD1341FD1C015A0015694DCA958A597BE1

Uniqueness

Uniqueness Score: -1.00%

Function 05239650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0523965A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2e338dfc8e09d078001207e80f13d4d3d29b6929371f16afaa7bf12569aa770a
Instruction ID: 3a38d024f0d48e1204408c6049e14a1ff5bebc9cdd19218e1027c9972dbf8396
Opcode Fuzzy Hash: 2e338dfc8e09d078001207e80f13d4d3d29b6929371f16afaa7bf12569aa770a
Instruction Fuzzy Hash: 9190027231504842D14471698444A4600259BD0345F91C011A00546D4D96A58D55BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 05239A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05239A5A

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 65494ecc9aae8062c6be700e0cfb0d96d96e4c80b51822424ab755988a283bf4
Instruction ID: 05849519d1243ff604207c14309f894f49c31372eec90654fba59efddd771b70
Opcode Fuzzy Hash: 65494ecc9aae8062c6be700e0cfb0d96d96e4c80b51822424ab755988a283bf4
Instruction Fuzzy Hash: A890026232180042D20465798C54B0700159BD0343F91C115A0144594CC99588616961

Uniqueness

Uniqueness Score: -1.00%

Function 052396E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 052396EA

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ac233ecadd83f3c2b8366cdc04cd6cf13559a0db3e2afea87c571e895c5eba3
Instruction ID: 8dbb8ce1a4f26b4db22372743175e1b970e6f46d59cf57abc237797b9381035e
Opcode Fuzzy Hash: 7ac233ecadd83f3c2b8366cdc04cd6cf13559a0db3e2afea87c571e895c5eba3
Instruction Fuzzy Hash: 4790027231108802D1146169C44474A00159BD0341F95C411A4414698D86D588917561

Uniqueness

Uniqueness Score: -1.00%

Function 052396D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 052396DA

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 308b7b6a0ba2f5a06e8df5350a260a22b82cb9b03d3ba88fe5b00c260fcf1c03
Instruction ID: a99733a30fd2880594f8e712813eef10426eddf6c1c9b350d6eeeb8c99335772
Opcode Fuzzy Hash: 308b7b6a0ba2f5a06e8df5350a260a22b82cb9b03d3ba88fe5b00c260fcf1c03
Instruction Fuzzy Hash: 1790027231100842D10461698444B4600159BE0341F91C016A0114694D8695C8517961

Uniqueness

Uniqueness Score: -1.00%

Function 032884B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70processmemoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03273B93), ref: 032884ED
CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03288584

Strings

.z`, xrefs: 032884DC, 032884E8

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateFreeHeapInternalProcess
String ID: .z`
API String ID: 1438695366-1441809116
Opcode ID: bedb68cb2a4f81a2d5f882d842c218954471b91a9d6171f6a7c3fdee7ccb150b
Instruction ID: d302ff9301d967845abef744625fce9ca3ebe9793ec14746c294bb3472a2dfd2
Opcode Fuzzy Hash: bedb68cb2a4f81a2d5f882d842c218954471b91a9d6171f6a7c3fdee7ccb150b
Instruction Fuzzy Hash: 1511F9B2211208BFDB14DF99DC84EEB77ADAF8C354F558259FA0DA7241C630E951CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03286ED0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 03286F78

Strings

net.dll, xrefs: 03286F41, 03286FC7, 03286F9F, 03286FAB, 03286FD3
wininet.dll, xrefs: 03286F2E, 03286F37

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: b68cd7a2022293f8b0ae9faa7826afc8d8a1f6c3102b37f9d1d84b4608bdc5e0
Instruction ID: aa99893867f13fe67eb5976b7343a10c2390b153aca6563c60c14d5470f9ae4d
Opcode Fuzzy Hash: b68cd7a2022293f8b0ae9faa7826afc8d8a1f6c3102b37f9d1d84b4608bdc5e0
Instruction Fuzzy Hash: C4316FB5652705ABC711EFA8C8A0FA7B7B8BF48704F04841DF61A6B280D770F585CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03286EC6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 03286F78

Strings

net.dll, xrefs: 03286F41, 03286F9F, 03286FAB
wininet.dll, xrefs: 03286F2E, 03286F37

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: df7efae97d7acd7d73bbc7cb2e175a94b1bc3f615eec4c368a3babe94caa82d9
Instruction ID: 19151c79dee7bad9a5268f27726ff71a81684e913d0fc103094e1de90b2ffc49
Opcode Fuzzy Hash: df7efae97d7acd7d73bbc7cb2e175a94b1bc3f615eec4c368a3babe94caa82d9
Instruction Fuzzy Hash: 33218FB5652305ABD710EFA4C8A0FA6BBB8BF48704F148019F61A5B280D770E485CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 032884C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03273B93), ref: 032884ED

Strings

.z`, xrefs: 032884DC, 032884E8

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 039e3460aac897a91aeae6fbf7cc948c6a758f56884f659ac76479d6e41247cc
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: EDE01AB52102046BDB14EF59CC44EA777ACAF88750F014554BA085B241C630E9108AF0

Uniqueness

Uniqueness Score: -1.00%

Function 03277260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 032772BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 032772DB

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 53e5322b62eb909e761c59486e91cb807ee3ea7040c4705f1c47c4bf58bd69dc
Instruction ID: 6d042b279d71dcce71be92dc7f2525d4dc18eab57a2751e579202844dcc88e60
Opcode Fuzzy Hash: 53e5322b62eb909e761c59486e91cb807ee3ea7040c4705f1c47c4bf58bd69dc
Instruction Fuzzy Hash: 2F018F35A913297AEB20F6949C02FBE766C6B00A50F140119FF04BE1C1E6E4694686F5

Uniqueness

Uniqueness Score: -1.00%

Function 03277206, Relevance: 3.0, APIs: 2, Instructions: 48threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 032772BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 032772DB

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 32d8694d81b0374004c17c31e5c8fd8e507cb58b1f3dd0ae592b512951fa5c67
Instruction ID: 95e6b6dce14988830f540c976f0a387878337731e1208d11b454ffe80f96a399
Opcode Fuzzy Hash: 32d8694d81b0374004c17c31e5c8fd8e507cb58b1f3dd0ae592b512951fa5c67
Instruction Fuzzy Hash: 51F02831A903253AEB20EB685C02FBF772C6F41A10F18444AFF04BE1C1E6F9695646E5

Uniqueness

Uniqueness Score: -1.00%

Function 032885C5, Relevance: 1.6, APIs: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03288584

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 7eb213214c4071e09337c73d7bdf1e56776c19dd2fd0a1485d39308d9ae588f3
Instruction ID: b3744525d4284a145af129c02d8030f09736dbb5751e6c6c4064b9698cd914ae
Opcode Fuzzy Hash: 7eb213214c4071e09337c73d7bdf1e56776c19dd2fd0a1485d39308d9ae588f3
Instruction Fuzzy Hash: 5001DAB6210208AFDB14DF99DC80EEB77ADEF8C750F118559FA5C97241CA30E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03279B10, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 03279B82

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: fe868f01399211142c9b6c4421b80a7d6e9fee322e993e22d4d6865ebdddac23
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: 9A0175B9D1020DA7DF10EBE4DC46F9DB378AF54208F044195E9089B280F671E784C791

Uniqueness

Uniqueness Score: -1.00%

Function 0328852E, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03288584

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 6b9c8881c9fbce652d2817e15d0c41d67e43b3058bf2911fd0b4ba349725bf45
Instruction ID: 25c92394234c27649bbc26b9e0d00d64c44bb4f8f49fef5bf17931add665ce16
Opcode Fuzzy Hash: 6b9c8881c9fbce652d2817e15d0c41d67e43b3058bf2911fd0b4ba349725bf45
Instruction Fuzzy Hash: D801FDB6214109ABCB04DF9CDC80DEB77AEAF8C314F258259FA4DA7241C630E8418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03288530, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03288584

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: b82e3ec088c441c975d07259353747cd10bf7178cf6fd4e8f58111128c53f3ef
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 4201AFB2210208ABCB54DF89DC80EEB77ADAF8C754F158258BA0DA7240C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 032884F2, Relevance: 1.5, APIs: 1, Instructions: 37processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 03288584

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: a28283032f9547995537310fb5352339906d14f8665fe6c93c7568d3df1329b5
Instruction ID: c59b6a09668c38e45e3b2b61f227e7d249249e38ec67b525cfa1548dcf701f65
Opcode Fuzzy Hash: a28283032f9547995537310fb5352339906d14f8665fe6c93c7568d3df1329b5
Instruction Fuzzy Hash: D5F0F8B2225104BFDB14EF98EC80EEB73ADEF8C750F118659FA1C97241C635E9518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03287000, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0327CCC0,?,?), ref: 0328703C

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 2f517c16c91e35fbe5d50bad8f74174133b78614e2715bc381d6170f1922d42a
Instruction ID: 8bb5c1837d40dae47dc87871928f12fa9327610739e8f8f20cf8889c15f6d849
Opcode Fuzzy Hash: 2f517c16c91e35fbe5d50bad8f74174133b78614e2715bc381d6170f1922d42a
Instruction Fuzzy Hash: ACE06D373913143AE330B699AC02FA7B29C9B81B20F180026FA0DEA2C1D595F84142A4

Uniqueness

Uniqueness Score: -1.00%

Function 03286FF4, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0327CCC0,?,?), ref: 0328703C

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: eb42f9e616ef9a9aa13f0a30150cd13278fd3249dbcd5ad56ad462bc61a46f66
Instruction ID: 1f19426495f486d3a1f522202fe195375332f1551ba7eb81eb11b5a8a8775b85
Opcode Fuzzy Hash: eb42f9e616ef9a9aa13f0a30150cd13278fd3249dbcd5ad56ad462bc61a46f66
Instruction Fuzzy Hash: 91F0A03A2913103BD330A6688C02FD777989F45B10F190019F649AF2C2D595B44186A5

Uniqueness

Uniqueness Score: -1.00%

Function 03288446, Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(03283506,?,03283C7F,03283C7F,?,03283506,?,?,?,?,?,00000000,00000000,?), ref: 032884AD

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 16d06c285db418bee41bf95754285ed0d1414b0374daabfcec378e9581ee6fd8
Instruction ID: fcb0eabece715ef0500f4f4f6285e8b8440c474e9c3019a01365983ca1be7f40
Opcode Fuzzy Hash: 16d06c285db418bee41bf95754285ed0d1414b0374daabfcec378e9581ee6fd8
Instruction Fuzzy Hash: E4F0A0B66043106BDB24FF98DC84EEB736DEF84390F144459FA485B240D531E914C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 03288620, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0327CF92,0327CF92,?,00000000,?,?), ref: 03288650

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: c6c52c668c8f66bd5e44bb07c92a3bbc20395716ddec581ce417c9c873691290
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: D9E01AB52002086BDB10EF59CC84EE737ADAF88650F018154BA086B241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 03288480, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(03283506,?,03283C7F,03283C7F,?,03283506,?,?,?,?,?,00000000,00000000,?), ref: 032884AD

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: a3ebd0f0d5c43217b079f89ced8936fbee952e44187c18a851ee95206e0aa7b3
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: BAE012B6210208ABDB14EF99CC40EA777ACAF88654F118558BA086B281CA30F9108AF0

Uniqueness

Uniqueness Score: -1.00%

Function 0327D400, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,03277C63,?), ref: 0327D42B

Memory Dump Source

Source File: 00000015.00000002.463320997.0000000003270000.00000040.00000001.sdmp, Offset: 03270000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: 397ba2059632bb32bf4ee58ed0ab2032e0ad7129dd1e8d9aac52c06cb5bd5635
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: 11D05E6A7A03043AEA10FAA4DC02F267289AF44A00F494064FA489A2C3DA60F40041A1

Uniqueness

Uniqueness Score: -1.00%

Function 0523967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05239694

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0e96c5f367c01d8a0764f5e31b9d9af68a01be1836b271d266acb2c8b48d65c6
Instruction ID: 0a85ee12f314f18ccef99bb768d07e3d817e5d0bc8104cddfae5e3d4eaddc84f
Opcode Fuzzy Hash: 0e96c5f367c01d8a0764f5e31b9d9af68a01be1836b271d266acb2c8b48d65c6
Instruction Fuzzy Hash: 75B09BB29164C5C5D715D7704608B2779157FD1741F56C061D1060681A47B8C0D1FDB5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0528FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0528FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0523CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E05285720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E05285720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0528fdda
0x0528fde2
0x0528fde5
0x0528fdec
0x0528fdfa
0x0528fdff
0x0528fe0a
0x0528fe0f
0x0528fe17
0x0528fe1e
0x0528fe19
0x0528fe19
0x0528fe19
0x0528fe20
0x0528fe21
0x0528fe22
0x0528fe25
0x0528fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0528FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0528FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0528FE2B

Memory Dump Source

Source File: 00000015.00000002.465610389.00000000051D0000.00000040.00000001.sdmp, Offset: 051D0000, based on PE: true

Associated: 00000015.00000002.466284446.00000000052EB000.00000040.00000001.sdmp Download File
Associated: 00000015.00000002.466300400.00000000052EF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 21f4030cf1f0e44e5b3ae44072b51b3ad1b0b1fb9d96e3d283abed4a02b940e1
Instruction ID: 45fc84a9959eba639c224058c589bcbdbe457ee8cadd99e8e1130432cdb5ca94
Opcode Fuzzy Hash: 21f4030cf1f0e44e5b3ae44072b51b3ad1b0b1fb9d96e3d283abed4a02b940e1
Instruction Fuzzy Hash: DEF0F676350601BFD6242A85DC46F33BB5AEF44730F144315F628561D1DBB2F86096F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Inquiry_10_05_2021,pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 00418260, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Function 00409B10, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Function 004181B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Function 004182DA, Relevance: 1.5, APIs: 1, Instructions: 36
nativeCOMMON

Function 004181AA, Relevance: 1.5, APIs: 1, Instructions: 33
filenativeCOMMON

Function 00418390, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON